feat: thin install.sh onboarding bootstrap (EGB-671)

Ships in the repo (clone already done). Checks age + jq + git, then PRINTS the
PATH line, onboarding next-steps, upgrade one-liner, and key-transfer hint.
Never edits shell rc, never runs sudo (prints the command). Exits non-zero with
an install hint when a dependency is missing.

install.sh

@@ -0,0 +1,113 @@
+#!/usr/bin/env bash
+#
+# secrets — thin onboarding bootstrap (EGB-671).
+#
+# This script ships INSIDE the repo: you already cloned the repo to get it, so
+# its only jobs are (1) verify the dependencies the tool needs and (2) print the
+# exact commands to finish setup. It deliberately does NOT:
+#   - edit your shell rc files (it prints the PATH line for you to paste)
+#   - invoke sudo or install packages behind your back (it prints the command)
+#   - re-implement any of the tool's security logic
+#
+# This is a security tool whose whole pitch is "verify, don't trust" — so the
+# installer holds itself to a higher bar than convenience, not a lower one.
+#
+# Usage:
+#   ./install.sh            # check deps, print setup + next steps
+#   ./install.sh --help
+
+set -euo pipefail
+
+# Resolve the directory this script lives in (the cloned tool repo). Uses bash
+# builtins only so it works under a minimal PATH.
+_src="${BASH_SOURCE[0]}"
+TOOL_DIR="$(cd "${_src%/*}" 2>/dev/null && pwd)"
+
+usage() {
+  cat <<EOF
+install.sh — finish setting up the 'secrets' tool.
+
+  Run this once after cloning the repo. It verifies dependencies (age, jq, git)
+  and prints the commands to put 'secrets' on your PATH and onboard a machine.
+
+Usage:
+  ./install.sh        Check dependencies and print setup + next steps
+  ./install.sh --help Show this help
+
+It never edits your shell config and never runs sudo — it prints the exact
+commands so you stay in control (this is a secrets tool, after all).
+
+Onboarding after setup:
+  First machine:  secrets init --remote <your-private-repo-url>
+  Other machine:  secrets join --remote <your-private-repo-url> --key <key.txt>
+EOF
+}
+
+# Print the install command for a package, using whatever package manager is
+# present. For sudo-requiring managers we PRINT the line for you to run — the
+# installer never escalates on its own.
+install_hint() {
+  local pkg="$1"
+  if command -v brew >/dev/null 2>&1; then
+    echo "brew install $pkg"
+  elif command -v apt-get >/dev/null 2>&1; then
+    echo "sudo apt-get install -y $pkg"
+  elif command -v dnf >/dev/null 2>&1; then
+    echo "sudo dnf install -y $pkg"
+  else
+    echo "install '$pkg' with your system package manager"
+  fi
+}
+
+case "${1:-}" in
+  --help|-h) usage; exit 0 ;;
+  "") ;;
+  *) echo "Unknown option: $1" >&2; usage >&2; exit 2 ;;
+esac
+
+echo "secrets — bootstrap check (tool dir: $TOOL_DIR)"
+echo ""
+
+# Dependency check. age + jq + git are all load-bearing on the cold-start path:
+# jq became required once .secrets.json (manifest) is JSON, so it must be present
+# BEFORE the first manifest read.
+missing=0
+for dep in git age jq; do
+  if command -v "$dep" >/dev/null 2>&1; then
+    echo "  ok   $dep"
+  else
+    echo "  MISSING $dep — install it with:"
+    echo "      $(install_hint "$dep")"
+    missing=1
+  fi
+done
+echo ""
+
+if [ "$missing" -ne 0 ]; then
+  echo "Install the missing dependencies above, then re-run ./install.sh." >&2
+  exit 1
+fi
+
+cat <<EOF
+All dependencies present. Two steps to finish:
+
+1) Put 'secrets' on your PATH. Add this line to your shell config
+   (~/.zshrc or ~/.bashrc), then restart your terminal:
+
+   export PATH="$TOOL_DIR:\$PATH"
+
+2) Onboard this machine:
+
+   First machine (new vault):
+     secrets init --remote <your-private-repo-url>
+     # then transfer key.txt to your other machines (AirDrop / scp / USB):
+     #   scp <this-host>:$HOME/.secrets/key.txt ~/.secrets/key.txt
+
+   Other machine (join an existing vault):
+     secrets join --remote <your-private-repo-url> --key <path-to-key.txt>
+     # 'join' clones the vault, installs the key, and VERIFIES it decrypts
+     # before declaring success — a mis-copied key fails loudly, not silently.
+
+To update the tool later:
+   git -C "$TOOL_DIR" pull
+EOF