feat: thin install.sh onboarding bootstrap (EGB-671)

Ships in the repo (clone already done). Checks age + jq + git, then PRINTS the
PATH line, onboarding next-steps, upgrade one-liner, and key-transfer hint.
Never edits shell rc, never runs sudo (prints the command). Exits non-zero with
an install hint when a dependency is missing.

test/install.bats

@@ -0,0 +1,72 @@
+#!/usr/bin/env bats
+# EGB-671: install.sh thin bootstrap. It ships IN the repo (you clone the repo
+# to get it), so its job is: verify deps (age + jq + git), PRINT the PATH line
+# and next-step commands — never edit dotfiles, never invoke sudo. Security-rail
+# concerns are operator-local (.ship-policy.json); these are functional checks.
+
+load test_helper
+
+INSTALL_SH="$(cd "$(dirname "${BATS_TEST_FILENAME}")/.." && pwd)/install.sh"
+
+@test "install.sh exists and is executable" {
+  [ -f "$INSTALL_SH" ]
+  [ -x "$INSTALL_SH" ]
+}
+
+@test "install.sh --help prints usage and exits 0" {
+  run "$INSTALL_SH" --help
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"install.sh"* ]] || false
+  [[ "$output" == *"join"* ]] || false
+}
+
+@test "install.sh prints the PATH export line for the tool dir (does not edit rc)" {
+  local tool_dir
+  tool_dir="$(cd "$(dirname "$INSTALL_SH")" && pwd)"
+  run "$INSTALL_SH"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"export PATH="* ]] || false
+  [[ "$output" == *"$tool_dir"* ]] || false
+  # It must NOT have written to any shell rc in the isolated HOME.
+  [ ! -f "$HOME/.zshrc" ]
+  [ ! -f "$HOME/.bashrc" ]
+}
+
+@test "install.sh prints both onboarding next-steps (init --remote and join)" {
+  run "$INSTALL_SH"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"secrets init --remote"* ]] || false
+  [[ "$output" == *"secrets join --remote"* ]] || false
+}
+
+@test "install.sh prints the upgrade one-liner" {
+  run "$INSTALL_SH"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"git -C"* ]] || false
+  [[ "$output" == *"pull"* ]] || false
+}
+
+@test "install.sh prints a key-transfer hint" {
+  run "$INSTALL_SH"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"key.txt"* ]] || false
+}
+
+@test "install.sh never invokes sudo (prints it for the user instead)" {
+  # No executed 'sudo' — any sudo reference must be quoted guidance text.
+  run grep -nE '^[[:space:]]*sudo ' "$INSTALL_SH"
+  [ "$status" -ne 0 ]
+}
+
+@test "install.sh reports a missing dependency with an install hint and non-zero exit" {
+  # Build a minimal PATH that has the tools install.sh needs but NOT jq.
+  local fake="$TEST_TMPDIR/fakebin"
+  mkdir -p "$fake"
+  for t in bash uname env cat grep sed tr dirname command age git printf; do
+    src="$(command -v "$t" 2>/dev/null || true)"
+    [ -n "$src" ] && ln -sf "$src" "$fake/$t" 2>/dev/null || true
+  done
+  run env PATH="$fake" "$INSTALL_SH"
+  [ "$status" -ne 0 ]
+  [[ "$output" == *"jq"* ]] || false
+}