user-local installs for claude and pi, fix sandbox mounts

Move claude and pi from sudo global installs to ~/.local. Claude
binary is copied to /usr/local/bin for sandbox visibility, pi runs
via node from ~/.local/lib (ro-mounted). Fix bwrap intermediate dir
traversal by setting 0755 perms on auto-created HOME dirs.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

scripts/setup.sh

@@ -695,35 +695,27 @@ else
   esac
 fi
 
-# ─── 14. npm global packages (system-wide) ──────────────────────────────────
+# ─── 14. npm global packages (user-local) ───────────────────────────────────
 echo ""
-echo "── npm global packages (system-wide) ──"
+echo "── npm global packages (user-local) ──"
+
+# Ensure ~/.local/bin is in PATH for this session
+export PATH="$HOME/.local/bin:$PATH"
 
 if ! has npm; then
   warn "npm not found — skipping global package installs"
 else
-  # Use explicit path to system npm if available, to avoid nvm conflicts
-  SYSTEM_NPM="/usr/bin/npm"
-  if [ ! -f "$SYSTEM_NPM" ]; then
-    SYSTEM_NPM="$(command -v npm)"
-  fi
-  
-  # Set npm prefix to system location so all users can access packages
-  echo "  Configuring npm global prefix to /usr/local..."
-  sudo "$SYSTEM_NPM" config set prefix /usr/local
-  ok "npm prefix set to /usr/local"
-
-  # Update npm itself to latest
-  echo "  Updating npm to latest..."
-  sudo "$SYSTEM_NPM" install -g npm@latest
-  ok "npm updated to v$(npm --version 2>/dev/null)"
+  # Set npm prefix to user-local so no sudo is needed for installs/updates
+  echo "  Configuring npm global prefix to ~/.local..."
+  npm config set prefix "$HOME/.local"
+  ok "npm prefix set to $HOME/.local"
 
   # Pi (coding agent)
   if has pi; then
     skip "pi (@mariozechner/pi-coding-agent)"
   else
     echo "  Installing pi..."
-    sudo "$SYSTEM_NPM" install -g @mariozechner/pi-coding-agent
+    npm install -g @mariozechner/pi-coding-agent
     if has pi; then ok "pi installed"; else warn "pi install failed"; fi
   fi
 
@@ -736,20 +728,12 @@ else
     fi
   fi
 
-  # Fix ~/.pi ownership if needed (in case of mixed user/sudo installs)
-  if [ -d "$HOME/.pi" ]; then
-    if find "$HOME/.pi" -not -user "$USER" -print -quit 2>/dev/null | grep -q .; then
-      sudo chown -R "$USER:$(id -gn)" "$HOME/.pi"
-      ok "Fixed ~/.pi ownership to $USER"
-    fi
-  fi
-
-  # Claude Code
+  # Claude Code (uses Anthropic's own installer for auto-update support)
   if has claude; then
-    skip "claude (@anthropic-ai/claude-code)"
+    skip "claude (claude-code)"
   else
-    echo "  Installing claude-code..."
-    sudo "$SYSTEM_NPM" install -g @anthropic-ai/claude-code
+    echo "  Installing claude-code via Anthropic installer..."
+    curl -fsSL https://claude.ai/install.sh | sh
     if has claude; then ok "claude-code installed"; else warn "claude-code install failed"; fi
   fi
 
@@ -758,7 +742,7 @@ else
     skip "pm2"
   else
     echo "  Installing pm2..."
-    sudo "$SYSTEM_NPM" install -g pm2
+    npm install -g pm2
     if has pm2; then ok "pm2 installed"; else warn "pm2 install failed"; fi
   fi
 fi