Sudo ALL the things! Provisioner runs as the user.
Use absolute path to self due to `cd`.
Tar zero-length files correctly.
Clarify error messages.
Unpack to known, persistent path.

This will let provisioners install services (or crontab entries) to
re-run themselves at reboot, without requiring a network to launch it.
(They shouldn't assume a tmpdir is still there.)