tell the operator they are still root, once

Neither script ever becomes the user it sets the machine up for — a process cannot
change its own uid, so both run as root and drop privileges per command instead.
Everything Officer owns ends up belonging to that user and every pm2 process runs
as them, but the session you are left holding is root's.

Two things that fixes are invisible until they bite: group membership is fixed at
LOGIN, so the `docker` group just granted is not in the current session, and the
shell configuration was written into their home and is not loaded in root's. Both
present as "the machine is broken" rather than "log in again".

Printed by whichever half runs LAST. The first attempt put it at the end of both,
which says it twice on a full install — and the first time it is wrong, because
officer-setup is about to run and still needs the root session it tells you to
leave. install.sh is the only thing that knows whether anything follows, so it
sets OFFICER_SETUP_FOLLOWS and machine-setup stays quiet.

Also drops "Pre-flight complete. The remaining sections are not built yet." from
the end of officer-setup. All 11 sections exist; that line last made sense when 6
did.

Verified: bash -n on all three, the set -e behaviour of `$RUN_OFFICER && export`
under --machine-only, and the suppression across all five ways in.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/setup/machine-setup/machine-setup.sh

@@ -2522,6 +2522,34 @@ echo "    Officer:    $OFFICER_ROOT"
 [[ -n "${TS_IP:-}" && "$TS_IP" != "unknown" ]] && echo "    Tailscale:  $TS_IP"
 echo ""
 
+# ── Who you are when this exits ──
+#
+# Root. This script never becomes ${USERNAME} — it cannot, since a process cannot
+# change its own uid — so it stays root and drops privileges per command instead.
+# Everything written into their home was written that way.
+#
+# Worth saying out loud because the two things a fresh session fixes are both
+# invisible until they bite: group membership is fixed at LOGIN, so the `docker`
+# group just granted does not exist in this session, and their shell configuration
+# lives in their home and is not loaded in root's.
+#
+# Suppressed when officer-setup is about to run — install.sh sets the variable. It
+# would be wrong advice in the middle of an install, because the half that follows
+# still needs the root session this would tell you to leave.
+if [[ "$EUID" -eq 0 && -z "${OFFICER_SETUP_FOLLOWS:-}" ]]; then
+  echo -e "${BOLD}  You are still root.${NC}"
+  echo ""
+  echo "    This machine is set up for ${USERNAME}. To carry on as them:"
+  echo ""
+  echo -e "      ${BOLD}su - ${USERNAME}${NC}                     from this session"
+  echo -e "      ${BOLD}ssh ${USERNAME}@<this machine>${NC}       or log in fresh"
+  echo ""
+  echo "    A new session is what makes their docker group membership and their"
+  echo "    shell configuration take effect — neither applies to the session you"
+  echo "    are in now."
+  echo ""
+fi
+
 # Clean up progress file on success
 rm -f "$PROGRESS_FILE"