tell the operator they are still root, once

Neither script ever becomes the user it sets the machine up for — a process cannot
change its own uid, so both run as root and drop privileges per command instead.
Everything Officer owns ends up belonging to that user and every pm2 process runs
as them, but the session you are left holding is root's.

Two things that fixes are invisible until they bite: group membership is fixed at
LOGIN, so the `docker` group just granted is not in the current session, and the
shell configuration was written into their home and is not loaded in root's. Both
present as "the machine is broken" rather than "log in again".

Printed by whichever half runs LAST. The first attempt put it at the end of both,
which says it twice on a full install — and the first time it is wrong, because
officer-setup is about to run and still needs the root session it tells you to
leave. install.sh is the only thing that knows whether anything follows, so it
sets OFFICER_SETUP_FOLLOWS and machine-setup stays quiet.

Also drops "Pre-flight complete. The remaining sections are not built yet." from
the end of officer-setup. All 11 sections exist; that line last made sense when 6
did.

Verified: bash -n on all three, the set -e behaviour of `$RUN_OFFICER && export`
under --machine-only, and the suppression across all five ways in.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/install.sh

@@ -149,8 +149,18 @@ say ""
 
 # Not `set -e`'s job: a half that exits non-zero should say which half, and stop
 # before the next one starts on a machine that is not ready for it.
+# ── Who says "you are still root" ──
+#
+# Both halves end as root and both need to say so, but only the LAST one to run
+# should — otherwise a full install says it twice, once in the middle where it is
+# wrong, because officer-setup is about to run and still needs the privilege.
+#
+# So the rule is "say it if nothing follows you", and this is the only place that
+# knows whether anything does.
 if $RUN_MACHINE; then
+  $RUN_OFFICER && export OFFICER_SETUP_FOLLOWS=1
   bash "$MACHINE" || die "machine setup did not finish — fix what it reported, then run this again"
+  unset OFFICER_SETUP_FOLLOWS
 fi
 
 if $RUN_OFFICER; then