fix: run_tier3_demo.py data-root defaults to relative 'data' — pass absolute path

install-tier-3-4.sh didn't pass --data-root to run_tier3_demo.py, so
episode.py tried to mkdir a relative 'data/' in whatever CWD sudo
inherited. Pass $DATA_ROOT/data explicitly.

Closes spectral/CIS490#19

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

scripts/install-tier-3-4.sh

@@ -107,6 +107,7 @@ if [[ -z "${SKIP_VERIFY:-}" ]]; then
     if ! sudo -E -u cis490 "$PY" "$INSTALL_ROOT/tools/run_tier3_demo.py" \
             --module vsftpd_234_backdoor \
             --target-port 2121 \
+            --data-root "$DATA_ROOT/data" \
             --target-boot-timeout 240 \
             > /tmp/cis490-tier3-verify.log 2>&1; then
         log "verify run failed — log at /tmp/cis490-tier3-verify.log; dumping last 30 lines:"