swarmctl: interactive setup walks the first-run ceremony

swarmctl setup with no subcommand checks the setup status first, then takes the open steps one at a time: prompts for input, shows a running action as one live line, prints the store keys, root token and new password under a warning until the operator confirms, and names the deploy option for a step this host cannot do. It calls the code of bao init, bao grant-bootstrap, user add, forge make-admin, agent create, agent permissions set and agent set-state. Refuses without root or a terminal.

swarmctl/src/permissions.rs

@@ -51,17 +51,27 @@ pub(crate) fn set(
     permissions: &[String],
     unrestricted_internet: Option<bool>,
 ) -> Result<()> {
+    let stored = store(target, agent, permissions, unrestricted_internet)?;
+    print!("{}", render(&stored));
+    Ok(())
+}
+
+/// The round trip of [`set`], printing nothing.
+pub(crate) fn store(
+    target: &Target,
+    agent: &str,
+    permissions: &[String],
+    unrestricted_internet: Option<bool>,
+) -> Result<Permissions> {
     let uri = member(agent)?;
     let wanted = with_permissions(permissions, unrestricted_internet)?;
-    let stored: Permissions = runtime()?.block_on(send(
+    runtime()?.block_on(send(
         target,
         hyper::Method::PUT,
         &uri,
         Some(&wanted),
         "permissions-set",
-    ))?;
-    print!("{}", render(&stored));
-    Ok(())
+    ))
 }
 
 /// The record granting `permissions`. An empty name, as `--permissions ''`