officer-setup section 3: dependencies

bun install, as the account, in the checkout.

Two things stated because a failure here is otherwise opaque.

The lockfile is frozen — bunfig.toml sets [install] frozenLockfile = true — so
bun resolves from bun.lock and nothing else. A package.json that disagrees with
it is a hard failure rather than a quiet resolution, which is deliberate: the
friction exists so an unexplained lockfile change shows up in a diff. If the
install fails complaining about the lockfile, the section says that is the
frozen lockfile working and that it wants a human to read the diff, rather than
reporting a generic failure.

node-pty has no Linux prebuild, so this compiles it from source on every machine.
That is what build-essential and python3 are in machine-setup's core utils for,
and the section says so — the failure would otherwise surface much later as a
terminal that never starts.

Success is checked by the artefact rather than by the exit status: bun can
complete while the native module is not built, because it skips a dependency's
lifecycle scripts unless it trusts the package. So the section looks for
node_modules/node-pty/build/Release/*.node and, when it is missing, names the
consequence and the command that fixes it instead of reporting success.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/setup/officer-setup/lib/repo.sh

@@ -55,3 +55,28 @@ clone_repo() {
 }
 
 pull_repo() { as_owner "git -C '$(platform_dir)' pull --ff-only" /; }
+
+# -----------------------------------------------------------------------------
+# Dependencies
+# -----------------------------------------------------------------------------
+#
+# ── The lockfile is frozen, and that is the point ──
+#
+# bunfig.toml sets [install] frozenLockfile = true, so `bun install` resolves from
+# bun.lock and nothing else. A package.json that disagrees with the lockfile is a
+# hard failure rather than a quiet resolution — which is deliberate: the friction
+# exists so that an unexplained lockfile change shows up in a diff. See the
+# supply-chain note in CLAUDE.md.
+#
+# So a failure here is usually one of two things, and they need different
+# answers: the lockfile genuinely disagrees with package.json, or node-pty failed
+# to build. Both are reported as such rather than as "install failed".
+
+deps_installed() { [[ -d "$(platform_dir)/node_modules" ]]; }
+
+# node-pty has no Linux prebuild, so `bun install` compiles it every time. This is
+# the artefact that proves it worked, and its absence is why the terminal sidecar
+# would not start.
+node_pty_built() { compgen -G "$(platform_dir)/node_modules/node-pty/build/Release/*.node" >/dev/null 2>&1; }
+
+install_deps() { as_owner "cd '$(platform_dir)' && bun install 2>&1"; }