install report: first cut, generated by the helpers

Every run writes a timestamped install-report.md recording what was installed,
changed, kept, skipped, started and run as root. Written for an adversarial read:
the person who just ran a setup script off the internet hands it to an agent of
their choosing and asks whether it did anything it should not have.

Recorded by the HELPERS rather than by the sections. pkg_install and
install_config report themselves, so anything installed or written through them
appears whether or not a section author remembered — a section that has to
remember is a section that will forget, and an incomplete report is worse than
none because it reads as a full account.

"Kept" is recorded as carefully as "changed". Leaving somebody's .zshrc alone is
the claim a reviewer most wants substantiated, and it is invisible unless stated.

Secrets are redacted at the moment of recording rather than filtered at render,
so a credential never sits in memory formatted for printing. Verified against a
POSTGRES_URL and an api_key/password pair.

REPORT_FILE is passed through the sudo re-exec. It was not, first time, and the
report silently vanished — the third variable this evening lost to env_reset.

Unfinished on purpose, paused mid-task at the owner's request: machine-setup's 26
sections still only report through the two shared helpers, so the sections that
change system state directly — systemd units, netplan, ufw, sshd drop-ins — are
not yet recorded. That is the half a reviewer would care most about.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/setup/machine-setup/machine-setup.sh

@@ -48,6 +48,7 @@ done
 # lib/ so a step can eventually be read — or run — on its own without dragging the
 # whole script in. Definitions only; nothing in there acts.
 # shellcheck source=lib/base.sh
+source "$SCRIPT_DIR/../report.sh"
 source "$SCRIPT_DIR/lib/base.sh"
 # shellcheck source=lib/packages.sh
 source "$SCRIPT_DIR/lib/packages.sh"
@@ -87,6 +88,7 @@ echo -e "${BOLD}╚════════════════════
 [[ -n "${RE_ASK:-}" ]] && rm -f "$ANSWERS_FILE"
 load_answers
 
+trap report_flush EXIT
 detect_os
 echo ""
 info "Machine:  ${OS_NAME} (${ARCH})"
@@ -152,6 +154,7 @@ elif [[ "$EUID" -ne 0 ]]; then
     OFFICER_ROOT="${OFFICER_ROOT:-}" \
     SETUP_USERNAME="${SETUP_USERNAME:-}" \
     MACHINE_ROLE="${MACHINE_ROLE:-}" \
+    REPORT_FILE="${REPORT_FILE:-}" \
     bash "$SCRIPT_DIR/machine-setup.sh" "$@"
 fi
 
@@ -2521,3 +2524,5 @@ echo ""
 
 # Clean up progress file on success
 rm -f "$PROGRESS_FILE"
+
+report_mark_complete