Self-install a PATH wrapper so setup.sh works from any directory

Every invocation of setup.sh (bare, --list/--status, or with a service
name) now ensures /usr/local/bin/post-install exists and execs this
checkout's setup.sh by its real resolved path -- idempotent (only
writes when missing or pointing somewhere else) and silent except for
a one-line notice the first time it's actually created. Previously
this required cd'ing into the repo (or a manually-created wrapper) on
every box separately; now it's automatic on first run, no separate
setup step.

A plain symlink wouldn't have worked here: setup.sh finds its own
directory via ${BASH_SOURCE[0]}, which bash doesn't resolve through
symlinks, so a symlinked invocation would have set HERE to the
symlink's own directory instead of the repo's.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SpKTLpwAgZNooTacWeQLuc

setup.sh

@@ -26,6 +26,31 @@ set -uo pipefail
 
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 
+# ── Self-install a PATH wrapper, so "cd into the repo every time" stops
+# being necessary after the first run ────────────────────────────────────
+# ${BASH_SOURCE[0]}-based HERE above means a plain symlink into
+# /usr/local/bin wouldn't resolve correctly (bash doesn't follow symlinks
+# for BASH_SOURCE, so a symlinked invocation would set HERE to the
+# symlink's own directory, not this repo's) — a thin wrapper that execs
+# THIS checkout's setup.sh by its real, already-resolved path sidesteps
+# that entirely. Runs on every invocation (bare, --list/--status, or a
+# service name) but is idempotent and silent unless something actually
+# needs writing, so it doesn't add noise to a normal run. Root-only: a
+# non-root invocation (e.g. --list) can't write to /usr/local/bin anyway,
+# and skipping silently beats a permission-denied on every read-only
+# command.
+if [ "${EUID:-$(id -u)}" -eq 0 ]; then
+    _CLI_WRAPPER="/usr/local/bin/post-install"
+    _WANT_WRAPPER="#!/bin/bash
+exec \"${HERE}/setup.sh\" \"\$@\""
+    if [ "$(cat "$_CLI_WRAPPER" 2>/dev/null)" != "$_WANT_WRAPPER" ]; then
+        if printf '%s\n' "$_WANT_WRAPPER" > "$_CLI_WRAPPER" 2>/dev/null && chmod +x "$_CLI_WRAPPER" 2>/dev/null; then
+            echo "[INFO] Installed 'post-install' — run it from anywhere from now on (e.g. post-install asterisk)."
+        fi
+    fi
+    unset _CLI_WRAPPER _WANT_WRAPPER
+fi
+
 # whiptail requires a valid TERM; when piped through bash (curl | bash) TERM
 # may be unset, causing raw-mode to fail and arrow keys to leak to the shell.
 export TERM="${TERM:-xterm-256color}"