install.sh: clone anywhere, run one command

A manifest declares repo path -> target, and the script walks it. Symlinks, not
copies, so an installed file edits the repo and one commit reaches every other
machine. Idempotent — a correct link is a no-op, safe after every pull. A real
file where a link should go is moved to .bak-<timestamp> and reported, because
on a new machine that may be the only copy of something written by hand.

Conditional targets are what make it portable: officer.dev/CLAUDE.md and the
officer-chat-events hook both name ~/officer-dev/platform, so a laptop with no
Officer install gets neither instead of getting a document that lies.

mask-secret is a command now rather than a path only true on this machine, and
user/CLAUDE.md says so. It is a generated wrapper, not a symlink, and that is
forced: mask-secret.py resolves its own path to find mask-hooks.d, so a symlink
would reach back into the repo and run every machine's hooks. The wrapper sets
MASK_HOOKS_DIR to the ones this machine installed and still runs the script from
the repo, so no code is copied.

Verified against a scratch HOME: re-run is all ok, the hand-written file
survives as .bak, and a machine without Officer skips both conditional lines.

user/CLAUDE.md

@@ -87,7 +87,7 @@ When he pastes a secret, mask it in the stored history as soon as you have
 finished using it — same turn, unprompted. He reloads and sometimes shares whole
 chat histories, and that is the copy that matters to him.
 
-    printf '%s' '<secret>' | ~/projects/claude-mds/tools/mask-secret.py
+    printf '%s' '<secret>' | mask-secret
 
 It masks Claude Code's own transcripts (`~/.claude/projects/**/*.jsonl`) with
 asterisks of the same length, overwriting in place so the live session's appends
@@ -100,6 +100,9 @@ chat — a database, a mirror, a log shipper — declares it as a hook** in
 machine-specific stores to this file; add a hook, and describe it in that
 project's own `CLAUDE.md`.
 
+`mask-secret` is a command because `install.sh` made it one. It is missing only
+where this repo was never installed — see its README.
+
 **Do not mask a throwaway.** He sometimes sets a real password aside, hands you
 a temporary one so you can drive an API — Nginx Proxy Manager, a router, a
 service admin — and reverts it afterwards. Leave those in the history. They are