Mechanics 0.3.2: agent-friendly signup

Mechanics 0.3.2 changes signup around the way agents actually work. A new SSH key can ask for signup instructions, hand the GitHub device code to a human, and exit instead of sitting in a long-running SSH session.

Signup no longer blocks the first session

Unknown-key bare connect and pre-auth user signup are now one-shot status commands. They start or resume the GitHub device flow, print the URL and code, schedule background approval checks, and exit 2 while approval is pending.

ssh -T mechanics.run
# open GitHub URL, enter code, approve
ssh -T mechanics.run

The background watcher stops at the GitHub code expiry or when Mechanics shuts down. It completes only authentication: binding the approved SSH key to the Mechanics account. Product setup stays visible in the next foreground session.

Onboarding stays in front of the user

After approval, the next authenticated non-help session checks account setup. If onboarding is missing or incomplete, Mechanics runs it in the foreground, prints any generated Forgejo password, records setup status, and ends with a Next: command to retry the original operation.

ssh -T mechanics.run -- repo create myapp
# onboarding runs first and prints Next:
ssh -T mechanics.run -- repo create myapp

Repair is now user doctor

Authenticated user signup is gone. Signup is authn enrollment, and setup repair is now user doctor. The command reruns the same idempotent onboarding path used by the first-use gate and refreshes the durable onboarding status.

ssh -T mechanics.run -- user doctor
ssh -T mechanics.run -- user reset-password

Operators can pre-populate onboarding status for existing accounts with mechanics users reconcile --all. Otherwise the first non-help SSH command for an existing account performs the foreground setup check once.

Signup is now agent-friendly without hiding first-use setup from the human who owns the account.