Install drop-off funnel from install_step telemetry.

Returns, for the same time window the install-refs panel uses:

• steps: distinct machines reaching each step (ok), ordered as a retention funnel (most machines first), with fail counts.
• failures: every fail step with its detail reason + platform.

COHORT-SCOPED: the funnel only counts machines whose start step falls in the window (= installs that began in the window). Without this, a machine that installed months ago via npx but keeps heartbeating would drag its historical route event into every window, making the live DMG-vs-npx mix look stuck on npx. Steps cluster within minutes of start, so scoping by start-in-window gives the true per-install funnel.

Note: the granular step funnel only covers the curl/install.sh path. The notarized DMG-app completes via config_written, not these steps — so this diagnoses where curl installers drop, not total completion.