Add a One-Step Agent Setup for Hosts, a Single Menu Line, and the update-host Skill - #4087

)

## Summary

Answers the verdict on promotion PR #4088's latest Copilot round. That
verdict said the change left documentation describing the previous
bootstrap flow. It also corrects an earlier decline on #4088, which
wrongly said the fleet map's G1 entry was already current.

- `docs/fleet-map.md` G1 resolution: host mode ends with the agent
setup, the report reads the agent status, and the loaders hand the kit
its source commit. Its decision now names the agent setup's
Python-driven steps as the recorded exceptions.
- The cold-start flowchart draws the agent setup's real order:
agent-tools upgrade, skills, safety kit, then Codex and opencode rules.
It ends with installing a coding agent and re-running the setup before
the first session, because the setup's agent steps act only on agents
already installed.
- `README.md` no longer says a fresh machine finishes with the
guardrails in place.
- `host-setup/linux/README.md` and the `install-skills` headers no
longer say the bootstrap runs the skills step last.

## Open Findings

The local edit budget was spent, so both were fixed in this pull
request's review loop, in b55e871 and 62977f6. install-skills is the
one wrapper reaching outside host-setup/, and the kit headers say they
reach outside their platform directory. The cold-start text names the
Claude Code plugin registration beside the kit and the rules. A recorded
local pass over 62977f6 found nothing open.

- `host-setup/linux/install-skills.sh:4`,
`host-setup/windows/install-skills.ps1:2`, and the `install-safety-kit`
headers (`introduced`). "Like install-safety-kit and
install-global-rules, it reaches outside host-setup/" is false, because
those wrappers drive files under `host-setup/agent-safety/`. The
`install-safety-kit` headers carry the mirror claim from #4087.
- `README.md:202`, `docs/fleet-map.md:94` (`introduced`). With no
`claude` CLI, the skills installer skips the Claude Code plugin
registration as well. So that registration also waits for the re-run,
beside the kit and the host-wide rules.

🤖 Generated with [Claude Code](https://claude.com/claude-code)


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

<!-- coderabbit-ai-generated:v1 -->

## Summary by CodeRabbit

* **Documentation**
* Clarified that agent setup installs skills for supported coding agents
and that safety-kit and global-rule steps apply only to agents already
installed.
* Updated setup guidance to explain when to install an agent and rerun
setup.
* Revised the setup flow and descriptions of verification, PATH
handling, and installer dependencies.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

…kill (#4088)

## Summary

Promotes one change and its review follow-ups from `develop` to `main`.

- #4087: one action brings a host fully current for every coding agent,
and both host menus run it from a single line.
- `bootstrap.sh --agent-setup` / `bootstrap.ps1 -AgentSetup` runs four
steps in order. It upgrades the coding-agent CLIs already installed,
installs the fleet skills, and installs the Claude Code safety kit. It
then writes the host-wide rule blocks into Codex's and opencode's global
`AGENTS.md`, for each agent present.
- `--agent-status` reports all four read-only, and `--host` and `--dev`
now end with the agent setup.
  - A new `update-host` skill runs the setup from any session.
- The kit's stamp names the resolved commit when installed from a
bootstrap tree, which fixes items 2 and 3 of #2553. Item 1 of #2553,
installing the Claude Code CLI itself, stays open. Hooks for Codex and
opencode stay on #781.

- #4089: answers CodeRabbit's review of this promotion. The Windows
skill commands run the loader only after its download succeeds. The
status summary reports the agent-tools inventory as listed, failed or
not checked rather than current. `bootstrap.ps1` restores the
source-commit variables after a run, and `--agent-status --from-tree` no
longer needs curl, tar or flock. The rules wrappers prefer Python 3.11+.
Two findings were declined with evidence on their threads.

- #4090: the host-setup README's tree-lifetime paragraph no longer
counts the tree-keeping actions, and scopes itself to a run that fetches
its tree.
- #4091: the fleet map's G1 entry and cold-start flowchart describe the
agent setup. The README and the flowchart say the Claude Code plugin
registration, the safety kit and the host-wide rules act only on agents
already installed. So a fresh machine re-runs the agent setup after
installing a coding agent, before its first session. The
`install-skills` and `install-safety-kit` headers state where each
wrapper reaches.

- #4092: answers this promotion's attested local review. The Codex and
opencode rules files carry a digest of the rules written below their
header and note. A hand edit there now reads EDITED and is backed up
before the next rewrite. A non-blank Codex `AGENTS.override.md` makes
the status report SHADOWED and not current, and the setup never touches
it. Two findings from that review were declined with evidence: sharing
the skills installer's commit lookup, and the Python-less report.

- #4093: the Codex host-safety README says a non-blank
`AGENTS.override.md` keeps the host-wide rules from reaching Codex, and
takes their place as its instruction layer.

## Not Verified

- Native Windows end to end, a `verification` gap. Native Windows CI ran
the unit suite, including the new `global_rules.py` tests, and passed.
`bootstrap.ps1 -AgentSetup` / `-AgentStatus`, the Windows wrappers, tar
extraction and the user-profile writes have not run on a real Windows
host. Their PowerShell logic was exercised only through the
lifted-function tests under `pwsh`.

Refs #2553

🤖 Generated with [Claude Code](https://claude.com/claude-code)