Sync develop → main (CLI-in-installer + standard checks)

[saadqbal]

Brings main current with develop. Single delta since the last sync (#49): #202.

What this promotes (#202)

• CLI install as Step 5 of both installers (install.sh / install.ps1) — runs the tracebloc CLI's own signed installer; non-fatal (guarded source/call so a stale bootstrap degrades gracefully instead of aborting under set -e).
• New scripts/lib/install-cli.sh + bats/Pester coverage.
• New scripts/lib/... wiring + .github/workflows/standard-checks.yml emitting Lint + Unit tests (the org-standard required contexts), so client PRs stop sitting at "Expected — waiting for status to be reported."

Why now (rollout ordering)

This puts scripts/lib/install-cli.sh on main, which the live tracebloc.io/i.sh fetches from. It must land here before the website i.sh deploy (tracebloc-website#357, already merged to website develop) reaches prod — otherwise the live bootstrap would 404 fetching a lib not yet on main.

No chart release/tag is cut here (chart releases go via tracebloc-v* tags separately).

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes the post-connect installer path and pulls an external CLI installer at runtime, but Step 5 is explicitly non-fatal and stale-bootstrap guards limit breakage; CI additions are low risk.

Overview
Promotes develop → main with installer and CI updates so live bootstrap can fetch install-cli.sh from main before prod i.sh does.

Installer (Step 5): Both flows grow from four steps to five. After the client is connected, they install the official tracebloc CLI via github.com/tracebloc/cli release installers (bash: new scripts/lib/install-cli.sh; Windows: Install-TraceblocCli in a child PowerShell process). Failures warn only and never fail an otherwise successful install. Bash guards missing install-cli.sh / undefined install_tracebloc_cli so older bootstraps skip Step 5 instead of aborting under set -e. Bootstrap install.sh now downloads install-cli.sh. Roadmaps, step labels, and success summaries point users at tracebloc dataset push ./data.

CI: New .github/workflows/standard-checks.yml runs Lint (bash -n, ShellCheck) and Unit tests (bats) on every push/PR to protected branches—no path filters—so required branch-protection contexts always report.

Tests: bats for install_tracebloc_cli non-fatal behavior; Pester for Install-TraceblocCli.

^{Reviewed by Cursor Bugbot for commit dc287ca. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

👋 Heads-up — Code review queue is at 15 / 8

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• averaging-service#102 — chore(kanban): declare staging as prod-truth branch via .kanban.yml · author: @LukasWodka · no reviewer assigned
• averaging-service#98 — ci: add fr-gate caller workflow · author: @LukasWodka · no reviewer assigned
• client-runtime#79 — docs(chore: real merge commit to unblock PR #57 #59): feasibility — delete pod_tokens (and the reconciler)? · author: @saadqbal · no reviewer assigned
• data-ingestors#146 — test(schema): lock category enum to the engine's TaskCategory (anti-drift) · author: @LukasWodka · reviewer: @saadqbal
• data-ingestors#148 — Develop to prod · author: @divyasinghds · reviewer: @saadqbal
• design-system#19 — fix: un-track coverage/ and node_modules/ from git · author: @LukasWodka · no reviewer assigned
• design-system#22 — ci: add Vitest test workflow · author: @LukasWodka · reviewer: @aptracebloc
• design-system#23 — ci: add fr-gate caller workflow · author: @LukasWodka · no reviewer assigned
• docs#47 — docs(environment-setup): Installer UX: drop PriorityClass, fix namespace, one-per-machine guard, surface version #192 namespace/workspace flow (hold for client#192) · author: @LukasWodka · reviewer: @saadqbal
• frontend-app#499 — ci: add Vitest + Cypress test workflow · author: @LukasWodka · reviewer: @aptracebloc

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)