Returns true only on first launch after install (i.e., when sentinel not found). Creates the sentinel so subsequent launches return false. Falls back to UserDefaults if file write fails.