feat(install): add a wallet-neutral universal bootstrap

[A1igator]

Summary

• add one audited scripts/install.sh bootstrap for Claude Code, Codex, Hermes, shared, auto-detection, and repeated multi-harness targets
• keep every bootstrap path wallet-neutral by always forwarding --no-wallet; wallet creation and funding remain a separate explicit step
• support reproducible TENJIN_VERSION / --version installs and an explicit npm prefix without sudo
• keep the deferred OpenClaw target fail-closed before npm runs

Stack and scope

This PR is stacked directly on Hermes-only #113. It preserves #113’s native Hermes integration while removing all dependency on the deferred ClawRouter work in #118/#119.

The PR’s own diff is intentionally only:

• scripts/install.sh
• src/install-script.test.ts
• the corresponding README instructions

There is no ClawRouter option, signer lookup, wallet reuse, or external-wallet coupling. A Hermes install is simply:

curl -fsSL https://raw.githubusercontent.com/BackTrackCo/tenjin-agent/main/scripts/install.sh | bash -s -- --harness hermes

The script forwards tenjin install --harness hermes --no-wallet.

Bootstrap contract

• install tenjin-cli through npm without sudo
• detect harnesses or forward explicit claude, codex, hermes, and shared targets
• support multiple explicit harness targets without duplicate forwarding
• reject mixed auto and explicit targeting
• reject OpenClaw as deferred before any npm mutation
• reject wallet-provider options; the bootstrap has no external-wallet coupling
• always pass --no-wallet, including auto-detected, Hermes, and multi-harness installs
• validate Node 22+, platform, version/tag, prefix, and harness before installation
• support an exact npm version/tag and an explicit absolute install prefix
• report when the installed bin directory is not on PATH

Verification

• pnpm format:check
• pnpm run typecheck
• pnpm run lint
• pnpm run build
• bash -n scripts/install.sh
• shellcheck scripts/install.sh
• 210 focused installer/Hermes tests pass, including nine isolated installer process tests

Priority

High (P1).

[greptile-apps]

A1igator has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

[greptile-apps]

A1igator has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

[A1igator]

Merged the refreshed #119 base in b6d5dd8; it applied cleanly. Verification is green: typecheck, lint, build, and the full suite (1,748 passed / 10 skipped).

[greptile-apps]

A1igator has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

[greptile-apps]

A1igator has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

[greptile-apps]

A1igator has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

[greptile-apps]

A1igator has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

[greptile-apps]

A1igator has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

[greptile-apps]

A1igator has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

[greptile-apps]

A1igator has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

[greptile-apps]

A1igator has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

[vraspar]

Owner decision: please close this PR. The wallet-neutral rework is acknowledged — stripping the ClawRouter coupling and forcing --no-wallet everywhere was the right response — but the bootstrap itself is being declined:

1. Both lanes already have one-step onboarding. Wallet-bearing users add the remote MCP URL and install nothing. Everyone else runs npx tenjin-cli@latest install --harness <x> — one command, no new artifact. The bootstrap saves a few keystrokes over npx at the cost of a curl-piped shell script we must audit, version, and own as a supply-chain surface forever.

2. Right now it is a delivery vehicle for unfixed defects. It is stacked on feat(install): add native Hermes retrieval and publish-back hooks #113, whose three review majors are open — including --no-hooks writing hooks anyway, and the config.yaml re-point corruption that fires on re-runs, which is exactly how curl|bash installers get used. A P1 installer is the wrong place for those to ship from.

3. Architecture decision on mcp: local server cleanup pass + remote-parity decision #92 puts onboarding effort into the one-page "add this URL / run npx" doc rather than a third install path. mcp: local server cleanup pass + remote-parity decision #92 (comment)

If distribution data later says a one-liner measurably converts better than npx, this branch is clean enough to revisit — after #113 stabilizes and with a decided distribution plan behind it.