docs: clarify privileged installer probes and scratch location

docs/install.md

@@ -10,7 +10,7 @@ for a plan using the whole disk you intend to erase:
 
 ```sh
 hydra-install
-hydra-install --disk /dev/CHOSEN_DISK --user YOUR_USER
+sudo hydra-install --disk /dev/CHOSEN_DISK --user YOUR_USER
 ```
 
 Replace the placeholders with an actual whole disk and your desired account
@@ -55,7 +55,7 @@ python3 dev/iso-smoke.py --iso /absolute/path/to/hydra-os.iso \
   --scratch-parent "$HOME/.cache/hydra-tests"
 ```
 
-The harness creates a private directory under `/tmp`, a new 32 GiB sparse
+The harness creates a private directory under `--scratch-parent` (`/tmp` by default), a new 32 GiB sparse
 qcow2 disk, and a private copy of OVMF variables. There is no existing disk
 argument. QEMU attaches the ISO read-only; serial and QMP use private Unix
 sockets. Tool overrides `--qemu` and `--qemu-img` support temporary development