feat(install): auto-add invoking user to kukeon group + surface re-login (step 3)

[eminwux]

Summary

• kuke init creates the kukeon group and lands the daemon socket root:kukeon 0o660, but never adds the invoking operator to the group — so the very first kuke client command the install banner suggests hits dial kukeond ... permission denied. This wires the installer to close that gap automatically while it still holds root.
• New grant_group_membership (runs after init, inside do_install): when a non-root $SUDO_USER is present, usermod -aG kukeon "$SUDO_USER". Idempotent — an already-member user is a clean no-op via an id -nG | grep -qxF membership check, never an error. Skipped cleanly when run directly as root (no $SUDO_USER, or $SUDO_USER=root) and when the group doesn't exist yet (e.g. KUKE_SKIP_INIT=1). This is a real privilege grant, so it is scoped strictly to the interactive installer's $SUDO_USER — never silently to other accounts.
• New print_group_note (called from print_next_steps): surfaces the re-login requirement before the first client command, with newgrp kukeon as the no-logout shortcut. States explicitly whether the user was just added vs already a member (KUKE_GROUP_GRANT records the outcome); prints nothing on a direct-root install.
• Regenerated the docs/site/install.sh mirror via make install.sh (the installer.yaml CI sync check is satisfied).

Coordinates with merged step 2 (#1245), which also edits print_next_steps — different lines (step 2 fixed the advertised commands; this adds the group/re-login note ahead of them). Per the issue's Notes, standalone kuke init auto-add is explicitly out of scope (a separate follow-up question); this covers the curl … | install.sh onboarding path only.

Test plan

• bash -n scripts/install.sh — syntax OK (script is set -euo pipefail).
• make install.sh + diff scripts/install.sh docs/site/install.sh — mirror byte-identical (the installer.yaml sync-check job).
• bash scripts/install.sh --check — exits 0, prereq path unaffected (the installer.yaml --check job).
• Isolated branch tests of grant_group_membership (stubbed getent/id/usermod): direct-root → skipped (no usermod); $SUDO_USER=root → skipped; non-member → added (usermod -aG kukeon invoked); already-member → already (no usermod). Confirmed the membership detector uses whole-line fixed-string match (grep -qxF) so kukeon can't match a kukeon-* group.
• Isolated render of print_group_note for all three KUKE_GROUP_GRANT states — added/already print the correct guidance, skipped prints nothing.
• AC item 5 — full hand-verification (fresh sudo install → newgrp kukeon → first kuke get … succeeds without EACCES) — not run on the dev host: it mutates a real account's group membership and runs kuke init against live containerd/cgroups, which would clobber unrelated host state. The constituent logic (each grant branch + the note for each state) is verified above in isolation; the end-to-end smoke is best run by the reviewer on a clean host.

Note on the named CI test target: the Go suite (make test, .github/workflows/test.yaml) is path-filtered to **/*.go / go.mod / go.sum and does not trigger on this shell-only diff. The CI surface that gates this change is .github/workflows/installer.yaml (sync check + --check), both green locally above.

Acceptance criteria

• On a fresh sudo-driven install, $SUDO_USER is added to the kukeon group automatically; re-running is idempotent (already-member is a no-op).
• Skipped cleanly when there is no non-root $SUDO_USER (direct-root install).
• The success message states the group was granted and tells the operator to newgrp kukeon (or re-login) before the first client command, with explicit just-added vs already-member wording.
• The docs/site/ install-script mirror matches.
• Verified by hand end-to-end — deferred to a clean host (destructive: mutates a real user's groups + runs kuke init); logic verified in isolation instead. See test plan.

Closes #1246

[eminwux]

PR #1307 Review — feat(install): auto-add invoking user to kukeon group + surface re-login

LGTM — closes the post-install dial kukeond ... permission denied gap by adding $SUDO_USER to the kukeon group while still root, correctly scoped to the sudo invoker and idempotent.

Checked and clean: grant_group_membership runs after kuke init creates the group; direct-root / SUDO_USER=root / KUKE_SKIP_INIT (group absent) all skip with state skipped so print_group_note prints nothing; the id -nG | tr | grep -qxF detector is a correct whole-line match; every pipeline sits in an if so set -euo pipefail won't trip; the usermod-fails branch warns instead of aborting; mirror docs/site/install.sh is byte-identical and all commits verified.

One non-blocking note: AC item 5 (fresh sudo install → newgrp kukeon → first kuke get without EACCES) is deferred as destructive — worth running on a clean host before merge, per the test plan.