feat: bootstrap.sh wraps the first command; the URL stays an argument

bootstrap.sh

@@ -0,0 +1,32 @@
+#!/bin/sh
+# bootstrap.sh -- the whole "first command" of a fresh machine, so nobody has
+# to remember chezmoi's incantation. Everything after this is dotup's job.
+#
+#   sh bootstrap.sh <public-repo-url>     # or run it bare and answer the prompt
+#
+# The repo URL is an argument rather than a constant for the same reason the
+# tests prompt for it: this tier is public and names no real host. Your own
+# paste-ready line lives in the private repo's runbook.
+set -u
+
+URL=${1:-${DOTFILES_URL:-}}
+# Prompt only when someone is there to answer: `curl | sh` and the test
+# harness both arrive with stdin not a terminal, and must fail fast instead
+# of hanging on a prompt nobody sees.
+if [ -z "$URL" ] && [ -t 0 ]; then
+	printf 'Public repo clone URL: ' >&2
+	IFS= read -r URL || :
+fi
+[ -n "$URL" ] || { echo "usage: bootstrap.sh <public-repo-url>" >&2; exit 2; }
+
+command -v curl >/dev/null 2>&1 \
+	|| { echo "bootstrap.sh: curl is required and not installed" >&2; exit 1; }
+
+# Not fatal -- the public tier applies fine as root -- but brew-only packages
+# (lazygit, omp, herdr) will refuse later, so say it now rather than then.
+[ "$(id -u)" -ne 0 ] || echo "bootstrap.sh: running as root — Homebrew will refuse later; a normal user with sudo is the happy path" >&2
+
+sh -c "$(curl -fsLS get.chezmoi.io)" -- init --apply "$URL" || exit 1
+
+echo
+echo "next: ~/.local/bin/dotup   (full path — this shell's PATH predates the install)"