Let the lead walk the user through permission and tool setup

internal/agents/kb/setup.md

@@ -0,0 +1,46 @@
+How to walk the human through setting up byre: the tools the server's agents need, vendor sign-ins, and the macOS permissions on the server's Mac and each client Mac.
+
+# Walking the human through setup
+
+Go one step at a time: check, say in a line or two what is missing and what it is for, fix what you can yourself, and ask the human only for what needs their hands (a password, a sign-in, a click on a macOS prompt). Check again after each fix, and finish with a short list of what is ready and what was left out on purpose. Ask which vendors the human wants (Claude, GPT, Gemini) before installing agent CLIs; one is enough.
+
+`byre` is `/Applications/Byre.app/Contents/Helpers/byre` and `byre-hands` is beside it, on every Mac with the app.
+
+## Tools on the server's Mac
+
+Agents run on the Mac byre runs on, the one your own Bash runs on. Check its tools with:
+
+```
+"$SHELL" -l -c '/Applications/Byre.app/Contents/Helpers/byre check'
+```
+
+It prints one JSON line: `ready` (false while something blocking is missing) and `checks`, each with `name`, `need` (`required`; `agent`, where one of claude, codex and agy is enough; or `optional`), `for` (what it is used for), `ok`, `command` (what installs it), `fix` (what to do after) and `blocking`.
+
+- Run each missing tool's `command` yourself through the login shell, `"$SHELL" -l -c '<command>'`. `brew` must be there first; installing Homebrew asks for the human's password, so ask them to run its installer in a terminal on that Mac (the app's Server tab there lists each missing tool with a Run in Terminal button). `xcode-select --install` opens a macOS dialog on that Mac's screen for the human to click Install.
+- Sign-in needs the human at a terminal on that Mac: `claude`, `codex login` or `agy`, each run once. `claude auth status` (JSON, `loggedIn`) and `codex login status` show whether one is signed in; agy has no status command, so ask.
+- The service's `PATH` is fixed when it is installed, and your own shell has the same one. When a tool is found through the login shell but not by `/Applications/Byre.app/Contents/Helpers/byre check` run directly, reinstall the service from the login shell so it picks the new `PATH` up: `"$SHELL" -l -c '/Applications/Byre.app/Contents/Helpers/byre install'`. That restarts byre and cuts your turn off; you resume with a restart message, so say before running it that you will carry on afterwards.
+- Google Chrome, for agents' browser tools, asks "downloaded from the Internet" on its first launch, and can't be driven until the human answers Open.
+
+## Permissions on the server's Mac
+
+Agents see and control the server's Mac, and read its Desktop, Documents, Downloads and iCloud Drive folders, through macOS privacy grants that belong to byre. Check them with a copy of `byre-hands` (each run needs its own path):
+
+```
+d=$(mktemp -d) && cp /Applications/Byre.app/Contents/Helpers/byre-hands "$d/" && "$d/byre-hands" check; rm -rf "$d"
+```
+
+It prints a JSON array, one entry per grant: `name`, `status` (`granted`, `missing`, or `unchecked` when the test couldn't run, such as Automation of Orion while Orion isn't running), `detail` (what to switch on) and `settings`, the `x-apple.systempreferences` URL of its System Settings pane.
+
+- A missing folder grant makes macOS show a prompt on that Mac's screen during the check, and the check waits until it is answered, so tell the human to be at that Mac before you run it, and give the call a timeout of a few minutes.
+- For Screen Recording, Accessibility and Automation, open the pane for the human with `open '<settings>'` and tell them which switch to turn on. Accessibility can list byre switched off; only the switch being on counts.
+- Check again after the human says they've done it.
+
+## Client Macs
+
+`list_clients` lists the human's Macs with the app open (and their iPhone, which needs nothing). Agents use a client Mac through `client_hands` and the client file tools, with grants that belong to byre's app there. Check them with `client_bash` on that Mac, running the same `byre-hands` command as above, and open a missing grant's pane there the same way with `open '<settings>'`. Ask before opening anything on a client Mac's screen, and only when the human is at it. The human can also run the check from the app's Settings tab on that Mac.
+
+Client Macs need no agent CLIs. Google Chrome is optional there, for agents' `chrome` tool on that Mac; `"$SHELL" -l -c 'brew install --cask google-chrome'` through `client_bash` installs it when `brew` is there.
+
+## What to leave alone
+
+Don't change anything the check reports as found, and don't install optional tools the human doesn't want.