install/docs: add tailscale-style bootstrap flow for baudbot

[benvinegar]

Summary

• add bootstrap.sh as a non-root entrypoint that installs a lightweight baudbot CLI into /usr/local/bin (using sudo/doas only when needed)
• keep full privileged install in baudbot install (which downloads/runs install.sh and publishes /opt/baudbot release snapshots)
• simplify README Quick Start to:
  1. curl .../bootstrap.sh | bash
  2. baudbot install
• update install.sh header comments to document the new flow
• update droplet CI setup scripts to validate the bootstrap flow (bootstrap.sh + baudbot install) instead of calling install.sh directly
• use local file:// overrides in CI so the uploaded source bundle is tested rather than GitHub main

Why

This provides the desired single-command bootstrap UX (similar to Tailscale) without requiring users to manually chmod temp files or run sudo curl ... | bash.

Testing

• bash -n bootstrap.sh
• bash -n bin/baudbot
• bash -n install.sh
• bash -n bin/ci/setup-ubuntu.sh
• bash -n bin/ci/setup-arch.sh
• BAUDBOT_BOOTSTRAP_TARGET=/tmp/baudbot-bootstrap-test BAUDBOT_CLI_URL=https://raw.githubusercontent.com/modem-dev/baudbot/benvinegar/readme-quickstart-no-sudo-curl/bin/baudbot bash -c "curl -fsSL https://raw.githubusercontent.com/modem-dev/baudbot/benvinegar/readme-quickstart-no-sudo-curl/bootstrap.sh | bash"
• bin/test.sh shell

[greptile-apps]

Greptile Summary

Updated Quick Start to download the install script as the current user before executing with sudo, avoiding the security risk of piping remote content directly to a shell. Also clarified that the installer publishes git-free runtime releases to /opt/baudbot/releases/<sha> and manages the /opt/baudbot/current symlink.

Changes:

• Added safer curl-based installation method as primary quickstart
• Moved git clone method to "Alternative" section
• Enhanced installer description with details about runtime release management

Confidence Score: 5/5

• Safe to merge - documentation-only change that improves security guidance
• This is a straightforward documentation improvement with no code changes. The new installation method is safer (avoids curl | sudo bash), and the additional context about runtime releases is accurate and helpful
• No files require special attention

Important Files Changed

Filename	Overview
README.md	Added safer curl-based quickstart that downloads script before execution, plus additional installation context

_{Last reviewed commit: 6f0e92c}