feat: add Claude Code cloud installer

[ark-archastro]

Review on ArchCode

Problem and author intent

Claude Code web environments run setup before session environment variables are available. Installing ArchDev and authenticating in that setup cannot use ARCHDEV_TOKEN; users otherwise have to maintain a multi-line setup and perform session-time login. Section 3.2 of the cloud-session design calls for a stable, hosted one-line installer whose fixes reach environments on snapshot refresh.

What changed

• Added install-cloud.sh: downloads the existing installer before executing it, installs the latest CLI to /usr/local/bin, skips shell path/completion changes, and configures Claude hooks using the installed executable.
• Adds a temporary SessionStart login hook that reads the token only at session time. Repeated setup preserves unrelated settings and avoids duplicate login hooks. Errors print diagnostics and return success so setup failures do not block the cloud session.
• Added README instructions, a release checklist, and five process-contract tests wired into the existing installer workflow.

Scope: installer tooling and documentation only; no frontend or backend runtime changes.

Risk and user impact

Medium: this configures cloud authentication and user-wide Claude hooks. Settings are replaced only after successful JSON transformation, and the token stays literal in the saved command. Independent review caught stale PATH selection; setup now invokes the installed executable explicitly.

The temporary login hook can race the first presence update because Claude runs matching SessionStart hooks in parallel. Section 3.1's direct environment-token resolution is the follow-up; wrapping stock startup hooks is not durable because CLI self-repair restores them. Users must use a personal environment because its token is visible to anyone using it.

Testing

• python3 scripts/test-cloud-installer.py: all five tests pass.
• bash -n install-cloud.sh and git diff --check: pass.
• Independent review completed; PATH finding fixed, startup race explicitly documented.
• Canonical local scenario: CloudInstallerTest.test_setup_then_session_login_preserves_settings_and_is_repeatable starts the real shell script with isolated settings and stub installer/CLI subprocesses, repeats setup, then executes the saved login command with session-only token values. It asserts preserved settings, no duplicate hook, no setup-time login, and silent, nonblocking login failure. This is a process-contract test, not live end-to-end proof.
• Automatic coverage: .github/workflows/installer-smoke-test.yml, unix-installer Linux/bash matrix entry, runs the entire Python file on every PR, main push, and manual dispatch. No service prerequisite or skip inside the test runner. Shell changed-line coverage is not instrumented in this public repository; firstlanding's Aster/coverage targets do not own these files.
• ShellCheck was unavailable locally (installed shim has no selected version).

Follow-ups

After merge makes the main-branch URL available, perform the real Claude cloud session proof in RELEASE_CHECKLIST.md: hosted download, fresh setup snapshot, hook dispatch, authentication, presence, and an explicitly requested team-room post in auto mode. This has not been run. Once section 3.1 is released, remove the temporary login bridge as described in the checklist.