We need deterministic installs, not just immutable OS's

Nope.

I do not mind replacing sh with install command that deals with file ownership and file permission.

But to let systemd do that “install” is already implenting a broken multi-level security (MLS) model.

Reference:

- https://en.wikipedia.org/wiki/Multilevel_security