feat(setup): ping agent before chat, detect stale service, auto-install Claude

Round-trip confirmation before first chat. After cli-agent wires up the
Terminal Agent, send `chat ping` through the CLI socket under a spinner
with 30s timeout (shared helper in setup/lib/agent-ping.ts, also used by
verify). Only after a real reply do we show "Your assistant is ready."
and enter the chat loop. Ping failures surface a targeted note
(socket_error vs no_reply) and skip the prompt — so users never type
into the void.

Checkout-mismatch detection. verify resolves the running service PID's
script path via `ps -p <pid> -o command=` and compares to projectRoot.
If the service is running from a sibling clone (common for developers
with multiple checkouts), SERVICE comes back as running_other_checkout
instead of running, AGENT_PING is skipped, and the failure note tells
the user exactly which bootout + bootstrap pair to run.

Native Claude Code install on demand. Only the subscription auth path
needs `claude`; the paste-token and paste-API-key paths don't. So
register-claude-token.sh now runs setup/install-claude.sh when `claude`
is missing (curl -fsSL https://claude.ai/install.sh | bash), then
prepends ~/.local/bin to PATH in-process so the rest of the script can
see the fresh binary.

Gutter-safe wrapping. wrapForGutter + dimWrap in lib/theme.ts hard-wrap
text to `process.stdout.columns - gutter` on word boundaries, measuring
visible length (ANSI-stripped). dimWrap applies the dim envelope per
line because clack resets styling at each line break when rendering
multi-line log content — a single outer dim() only colors the first
line. Applied to the long "why" notes before container + onecli, the
channel-skip info, the ping-failure note, and the checkout-mismatch
remediation.

Wordmark anchoring. printIntro always includes the NanoClaw wordmark in
the clack intro line, whether or not nanoclaw.sh already printed one in
bash. Worth ~1 line of redundancy so the brand stays visible at the top
of the clack session after bootstrap output scrolls out.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

setup/install-claude.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+# Install the Claude Code CLI on the host via the official native installer.
+# Invoked from setup/register-claude-token.sh when the user picks the
+# subscription auth path and `claude` is missing. The other two auth paths
+# (paste OAuth token, paste API key) don't need the CLI, so this runs on
+# demand rather than up front.
+#
+# The native installer is Node-independent (downloads a prebuilt binary to
+# ~/.local/bin) and is the path Anthropic documents. This matches the
+# pattern used by install-docker.sh / install-node.sh: the script itself is
+# the allowlisted unit; the curl | bash pipe lives inside it.
+
+set -euo pipefail
+
+echo "=== NANOCLAW SETUP: INSTALL_CLAUDE ==="
+
+if command -v claude >/dev/null 2>&1; then
+  echo "STATUS: already-installed"
+  echo "CLAUDE_VERSION: $(claude --version 2>/dev/null || echo unknown)"
+  echo "=== END ==="
+  exit 0
+fi
+
+if ! command -v curl >/dev/null 2>&1; then
+  echo "STATUS: failed"
+  echo "ERROR: curl not available."
+  echo "=== END ==="
+  exit 1
+fi
+
+echo "STEP: claude-native-install"
+curl -fsSL https://claude.ai/install.sh | bash
+
+# Native installer writes to ~/.local/bin and appends a PATH line to the
+# user's rc file; that doesn't help this session, so put it on PATH now.
+if [ -d "$HOME/.local/bin" ] && [[ ":$PATH:" != *":$HOME/.local/bin:"* ]]; then
+  export PATH="$HOME/.local/bin:$PATH"
+fi
+hash -r 2>/dev/null || true
+
+if ! command -v claude >/dev/null 2>&1; then
+  echo "STATUS: failed"
+  echo "ERROR: claude not found on PATH after install."
+  echo "=== END ==="
+  exit 1
+fi
+
+echo "STATUS: installed"
+echo "CLAUDE_VERSION: $(claude --version 2>/dev/null || echo unknown)"
+echo "=== END ==="