Always verify nix store on install

Just wasted a couple hours chasing shadows because the nix store got corrupted and there was no indication of that anywhere.

Since an install is one-time only, might as well verify and optimize.
The optimization also showed that the copied files aren't read-only; fixed that as well.

Also, use /bin/sh since there's a good chance that this script will be run on systems
without /bin/bash