docs(strong): record age-key issuance and the 3 bootstrap.sh bugs found fixing it

strong now has its own age key (issued over LAN via --no-mesh),
pubkey recorded in inventory.yaml. Not yet granted to any secrets
file - that's a separate decision.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

hosts/strong.md

@@ -49,11 +49,14 @@ Proxmox VE on 2026-07-01. No LXCs/VMs deployed on it yet.
 - **Homelab-context client enrollment:** done 2026-07-01 via
   `bootstrap.sh --no-secrets` (reused the operator's existing Gitea PAT for
   the initial clone). `/opt/homelab-context`, the `homelab` CLI, and the
-  5-min sync timer are live; `homelab whoami` resolves correctly. No age
-  key / secrets access yet (skipped along with Netbird — but bootstrap's
-  own mesh check reported `mesh: lan`, meaning secrets issuance would
-  actually work over plain LAN if re-run without `--no-secrets`, no mesh
-  join required). See [agent-enrollment.md](../operations/agent-enrollment.md).
+  5-min sync timer are live; `homelab whoami` resolves correctly. See
+  [agent-enrollment.md](../operations/agent-enrollment.md).
+- **Age key / secrets:** issued the same day over plain LAN (no Netbird
+  needed — see the `--no-mesh` bootstrap.sh fix below). Key lives at
+  `/etc/age/key.txt`; pubkey `age1rtwvdct6avjkr3cyxv3vue3vqx4d524fjfr3vk7xrnvyrylnry5sm54sn4`
+  recorded in `inventory.yaml`. Not yet a recipient on any actual secret
+  (`hello.yaml`, `gitea-pat.yaml`, etc.) — that's a separate grant, see
+  ["Granting a secret to a new client"](../operations/agent-enrollment.md#granting-a-secret-to-a-new-client).
 
 ## Cluster membership
 
@@ -80,6 +83,14 @@ needed going forward.
 
 ## Changelog
 
+### 2026-07-01 — age key issued over LAN; 3 bugs found/fixed in bootstrap.sh
+Re-ran bootstrap without `--no-secrets` to get a real age key. Hit three real bugs live, fixed all three in `bootstrap.sh` and re-ran clean:
+1. The `mcp`-CLI pipx-install step and the (unused, `--with-hermes`-only) Goose installer both called `sudo -u <user>` unconditionally — fails with "sudo: command not found" on a minimal root-only image with no `sudo` binary at all. Added a `run_as()` helper that only shells out to `sudo` when there's a real distinct invoking user.
+2. `sops` isn't an apt/dnf package (matches what `agent-enrollment.md`'s manual-install recipe already does) — the auto-installer tried `apt-get install sops` and failed outright. Added `install_sops_binary()`, fetching the GitHub release binary directly on both dnf and apt paths.
+3. Bigger one: running without `--no-secrets` unconditionally tries to install + interactively connect Netbird (device-code SSO), even though the very next check already knows how to accept plain LAN reachability instead. Over SSH with nobody watching, this hangs forever — had to manually kill a stuck `netbird up` process. Added `--no-mesh`, which skips the Netbird install/connect step but keeps the LAN-fallback path for secrets issuance. This run used `bootstrap.sh --no-mesh` and completed cleanly: `mesh: lan`, age key installed, `mcp` CLI installed via pipx (proving fix #1 too).
+
+Result: age key at `/etc/age/key.txt`, pubkey recorded in `inventory.yaml`. Not yet granted access to any actual secret file — see the note above.
+
 ### 2026-07-01 — enrolled as a homelab-context client
 Ran `bootstrap.sh --no-secrets` (reused the operator's existing personal Gitea PAT for the initial clone rather than minting a fresh read-only one). Installed git, cloned `/opt/homelab-context`, installed the 5-min systemd sync timer, symlinked `homelab` CLI and `AGENTS.md`. Skipped age-key/secrets issuance and Netbird per operator choice — but bootstrap's own connectivity check reported `mesh: lan`, i.e. the secrets-issuance endpoint is already reachable over plain LAN, so re-running without `--no-secrets` later wouldn't require a Netbird join. Known gap: the `mcp` pipx CLI install step silently failed (`sudo: command not found` — bootstrap.sh's pipx step assumes a `sudo` binary even when already root; harmless, only affects the `homelab mcp <tool>` shell subcommand).
 

hosts/strong.yaml

@@ -26,6 +26,7 @@ notes:
 - "First step of the planned library-SSD migration \u2014 see .hermes/plans/2026-06-03_110000-library-ssd-migration-to-ludo-mini.md\
   \ (filename kept as-is, it's a historical planning doc). Only Phase 1 (Proxmox install + cluster join)\
   \ is done; no physical drive move, service migration, or GPU passthrough has happened yet."
+age_pubkey: age1rtwvdct6avjkr3cyxv3vue3vqx4d524fjfr3vk7xrnvyrylnry5sm54sn4
 see_also:
 - hosts/strong.md
 mcp_endpoint: https://mcp.hubris.network/mcp

inventory.yaml

@@ -394,6 +394,7 @@ hosts:
       (filename kept as-is, it's a historical planning doc). Only Phase 1
       (Proxmox install + cluster join) is done; no physical
       drive move, service migration, or GPU passthrough has happened yet.
+    age_pubkey: age1rtwvdct6avjkr3cyxv3vue3vqx4d524fjfr3vk7xrnvyrylnry5sm54sn4
   netbird-vps:
     kind: external
     os: linux