declare_ruth stored the default set plus manage_root_agent over whatever ruth held, so a rerun dropped permissions granted since. It now reads her record and adds manage_root_agent only when it is missing, and writes nothing when she holds it. A new ruth still gets the defaults plus manage_root_agent.
swarmctl setup with no subcommand checks the setup status first, then takes the open steps one at a time: prompts for input, shows a running action as one live line, prints the store keys, root token and new password under a warning until the operator confirms, and names the deploy option for a step this host cannot do. It calls the code of bao init, bao grant-bootstrap, user add, forge make-admin, agent create, agent permissions set and agent set-state. Refuses without root or a terminal.
