warn against working as root at the username prompt

root was already refused as an answer, but only the refusal said so — and only
after somebody typed it. The advice now comes with the question, along with why:
no safety net, a typo in a path that deletes instead of refusing, and nothing to
distinguish you from a process that got out of hand.

An extra warning when SUDO_USER is unset. That means the script was started as
root rather than through sudo, which usually means root is how they log in — the
exact situation the general advice is about, and the one where general advice is
easiest to assume is aimed at somebody else. It says so plainly instead.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/setup/machine-setup/lib/base.sh

@@ -189,9 +189,27 @@ ask_username() {
   else
     echo ""
     info "Which account is this machine for?"
-    echo "     The account you log in and work as — not root. It will be created"
+    echo "     The account you log in and work as, day to day. It will be created"
     echo "     if it does not exist."
     echo ""
+    warn "Strongly advised: use a normal account, not root."
+    echo "     Working as root means everything runs with no safety net. A typo in"
+    echo "     a path deletes instead of refusing, anything you run has the whole"
+    echo "     machine, and nothing distinguishes you from a process that got out"
+    echo "     of hand. sudo gives you the same power when you ask for it, and"
+    echo "     only then — which is why root is not accepted as an answer here."
+
+    # No SUDO_USER means this was started as root rather than through sudo, which
+    # usually means root is how they are logged in. That is exactly the situation
+    # the advice above is for, so it is worth saying plainly rather than leaving
+    # as general guidance they can assume is aimed at somebody else.
+    if [[ -z "${SUDO_USER:-}" ]]; then
+      echo ""
+      warn "You are running this as root directly, not through sudo."
+      echo "     If root is how you normally log into this machine, now is the"
+      echo "     moment to make an account and stop doing that."
+    fi
+    echo ""
     while [[ -z "${answer:-}" ]]; do
       if ! read -rp "  Username${default:+ [$default]}: " answer; then
         echo ""