--unattended: every question that has a default answers itself

51 yes/no prompts and ~20 free-text ones, of which about six actually need a human.
The line drawn is "a question with a default answers itself; a question with no
possible default still asks", so it stays attended without being a conversation.

Half of it already existed: ASSUME_YES=1 was implemented and honoured by confirm()
in both scripts, returning each question's OWN default — so a "do the thing you
asked for" question goes yes and a genuine extra goes no. --unattended sets it.

The new part is menu_answer(), for the eight numbered menus. It sets the variable
EMPTY rather than passing a default in, because every menu already consumes its
choice as `${CHOICE:-<n>}` — the default lives next to the options it selects
between, which is the right place, and a second copy in the helper could drift from
the one the prompt advertises. Verified all eight consume that way before touching
them. `read <<<''` rather than eval or `declare -g`, which is bash 4.2+ and rules
out the bash 3.2 macOS still ships.

officer-setup's ask_required takes its default too, except where there is none — the
owning account on a machine machine-setup never ran on, where a guess would install
as the wrong user.

STILL ASKS, deliberately: the username; the Tailscale control plane, login server
and auth key; the git identity; and an SSH public key when the account has none.
That last one is a trap I nearly walked into — on a fresh VPS KEY_COUNT==0 forces
ADD_KEY=true with no confirm, and the menu's default is "[1] paste a public key",
which then prompts with no default at all. Auto-answering that menu would hang or
fail, so it is excluded by name. adduser also still asks for a password; that is
the tool, not us.

Two pre-existing bugs fixed on the way: machine-setup's sudo re-exec passed "$@"
after `shift` had emptied it, so --only and --reask stopped existing the moment it
escalated — same bug as officer-setup had. And UNATTENDED/ASSUME_YES are named in
all three sudo lists, because env_reset would otherwise drop the flag at
escalation, which is now the fourth variable lost that way.

Verified: bash -n on five files, --help on all three, and menu_answer + confirm
under the flag showing a menu resolving to its default and a no-default confirm
correctly answering no.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/install.sh

@@ -66,6 +66,11 @@ while [[ $# -gt 0 ]]; do
       shift
       ;;
     --repo=*) OFFICER_REPO="${1#--repo=}" ;;
+    # Every question that HAS a default answers itself. The ones with no possible
+    # default still ask — see the note above the run below.
+    --unattended | -y)
+      export UNATTENDED=1 ASSUME_YES=1
+      ;;
     -h | --help)
       say "usage: install.sh [--machine-only | --officer-only] [--repo <url>]"
       say ""
@@ -73,9 +78,16 @@ while [[ $# -gt 0 ]]; do
       say "  --machine-only  stop after the machine is provisioned"
       say "  --officer-only  the platform only, on a machine you already trust"
       say "  --repo <url>    clone the platform from here instead of the default"
+      say "  --unattended    take the default for every question that has one (-y)"
       say ""
       say "  The default is a private Gitea over SSH, which only authenticates on a"
       say "  machine whose key it already knows. Pass an https URL on a fresh box."
+      say ""
+      say "  --unattended still asks the questions that have no possible default:"
+      say "    the username, the Tailscale control plane / login server / auth key,"
+      say "    an SSH public key when the account has none, and the git identity."
+      say "  Answer those ahead of time with SETUP_USERNAME, TS_LOGIN_SERVER,"
+      say "  TS_AUTHKEY and TIMEZONE to reduce it further."
       exit 0
       ;;
     *) die "unknown option: $1" ;;
@@ -131,6 +143,8 @@ if [[ "$KERNEL" != "Darwin" && "$EUID" -ne 0 ]]; then
     SETUP_USERNAME="${SETUP_USERNAME:-}" \
     MACHINE_ROLE="${MACHINE_ROLE:-}" \
     REPORT_FILE="${REPORT_FILE:-}" \
+    UNATTENDED="${UNATTENDED:-}" \
+    ASSUME_YES="${ASSUME_YES:-}" \
     OFFICER_REPO="${OFFICER_REPO:-}" \
     bash "$SELF" ${ORIGINAL_ARGS[@]+"${ORIGINAL_ARGS[@]}"}
 fi