scripts/setup is the initial install, nothing else

Two of the eight did not belong. cleanup-desktop.sh is the teardown — the inverse of an install, not part
of one. provision-user-dirs.ts runs per account at invite time, on a machine that is already set up.
Both are back at the top level, with their `../` derivations and usage strings put back.

What is left is what a fresh machine runs once: the two installers (setup.sh, setup_mac_light.sh), the
two things setup.sh calls (setup-dockers.sh, setup-desktop.sh), and the two files they deploy —
starship.toml, copied to ~/.config, and officer-set-display.sh, which setup-desktop.sh installs to
~/.local/bin as a login-time mode setter. The last one is not a setup script and does not read like one;
it is here because it is install payload, same as the toml, and setup-desktop.sh loads it by
`$(dirname $0)`.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

TODO.md

@@ -52,7 +52,7 @@ the owner's OS user and can never be granted. Indirection there really is accide
       `'Unverified'` and `signin.ts` refuses anything else with a bare UNAUTHORIZED, which is the trap
       the hand-INSERT route fell into. The owner sets the password and reads it out; `passwordChangedAt`
       stays null. Directories come from the shared `provisionUserDirs`/`USER_DIRS` in `data-path.ts`,
-      which `scripts/setup/provision-user-dirs.ts` now imports rather than restating.
+      which `scripts/provision-user-dirs.ts` now imports rather than restating.
 
 - [ ] **Still no invite flow, and no password reset for a member.** The owner types the password and
       tells the person, which means the owner knows it and the member cannot change it back if they