put the superseded setup scripts in setup-old, and repair what the move broke

scripts/setup/ is now what the new installer is being built in — machine-setup/
for the box, officer-setup.sh for the platform on top — and everything being
replaced moved to scripts/setup-old/. It still works and is still what to run.

Three things the move broke, and what each needed:

  starship.toml is not an old-setup artifact. os-user-shell.ts reads it at
  RUNTIME to seed a member's ~/.config/starship.toml when their Linux account is
  provisioned, and line 125 reads it inside a try whose catch returns
  "could not read the shell templates" — so account provisioning would have
  failed outright, not degraded. Moved back to scripts/setup/, which is where it
  belongs anyway (one file, both audiences) and which leaves the code correct
  with no edit.

  package.json's `setup` script pointed at a path that no longer exists. It now
  points at officer-setup.sh, where the installer is going, rather than at
  setup-old/ which is temporary.

  officer-setup.sh was created empty. An empty script exits 0, so `bun setup`
  would have reported success while doing nothing — worse than the broken path
  it replaced. It now explains that it is not written yet and exits 1, naming
  the setup-old script to run meanwhile.

Also brought .tmux.conf and ufw-docker-rules.conf in beside machine-setup.sh,
which reads both from SCRIPT_DIR and had been silently skipping them since the
script was vendored. ssh-keys.zip deliberately stays out: it is key material,
and *.zip is ignored.

Comments in os-user-claude.ts, app-store/preflight.ts and two docs still name the
old scripts/setup/setup.sh path. Left alone on purpose — repointing them at
setup-old/ only to repoint them again when officer-setup.sh lands is churn.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/setup/officer-setup.sh

@@ -0,0 +1,30 @@
+#!/bin/bash
+set -e
+
+# =============================================================================
+# officer-setup — the platform, on a machine that is already provisioned
+#
+# The second half of the install. machine-setup/ brings a blank box up to a
+# usable machine; this puts Officer on top of it: dependencies, .env, the
+# database schema, and the pm2 process list.
+#
+# Run:  bash scripts/setup/officer-setup.sh
+# =============================================================================
+#
+# NOT WRITTEN YET. It is being rebuilt from scripts/setup-old/setup.sh, which
+# still works and is still the one to run.
+#
+# This file exists ahead of its contents so that `bun setup` points at where the
+# installer is going rather than at a path that is about to move again. It fails
+# loudly rather than sitting empty, because an empty script exits 0 and would
+# make `bun setup` report success while doing nothing at all.
+
+echo ""
+echo "  officer-setup.sh is not written yet."
+echo ""
+echo "  It is being rebuilt from scripts/setup-old/setup.sh, which still works:"
+echo ""
+echo "      bash scripts/setup-old/setup.sh                       # full install"
+echo "      OFFICER_PROFILE=light bash scripts/setup-old/setup.sh # light install"
+echo ""
+exit 1