install(): apply trace-capture patches even on reinstall

The previous install() short-circuited at the top when
_prepare_headers_and_auth was already wrapped, which left the newly
added _patch_send_request / _patch_session_call_tool /
_patch_execute_on_server helpers unexecuted on any reinstall.  That
explained why the trace-capture INFO lines never appeared in
pallas.log despite the installed _fastagent_patch.py carrying the
new code.

Restructure install() so the bearer-forwarding block owns its own
idempotency guard inline, while the three _patch_* helpers are
always invoked — each already has its own 'already patched' guard
on the target method, so redundant calls are free and harmless.

pallas/_fastagent_patch.py

@@ -464,17 +464,25 @@ def _patch_execute_on_server() -> None:
 
 
 def install() -> None:
-    if getattr(_mcm._prepare_headers_and_auth, "_pallas_forward_patched", False):
+    # NOTE: we do NOT short-circuit on "already patched" at the top of this
-        return
+    # function — each individual ``_patch_*`` helper owns its own idempotency
+    # guard, and we want all three trace-capture patches to be applied even
+    # when the bearer-forwarding patch was installed in a previous reload.
+    # Previously a top-level guard on ``_prepare_headers_and_auth`` would
+    # return immediately on a reinstall, leaving the trace wrappers missing
+    # silently — which is exactly the failure we chased.
+    if not getattr(
+        _mcm._prepare_headers_and_auth, "_pallas_forward_patched", False
+    ):
         _refresh_forward_servers()
         _prepare_headers_and_auth_with_forward._pallas_forward_patched = True  # type: ignore[attr-defined]
         _mcm._prepare_headers_and_auth = _prepare_headers_and_auth_with_forward
-    _patch_send_request()
-    _patch_session_call_tool()
-    _patch_execute_on_server()
         # INFO so it always appears in the journal at boot — greppable proof
         # that the patch ran before any agent started.
         logger.info(
             "bearer-forwarding patch installed "
             "(forward_inbound_auth-aware _prepare_headers_and_auth)"
         )
+    _patch_send_request()
+    _patch_session_call_tool()
+    _patch_execute_on_server()