bootstrap: install mcp CLI via pipx on workstation enrollment

G1 from the apt-sweep backlog. After ssh ControlMaster setup, install
the `mcp[cli]` python package via pipx so `homelab mcp <tool>` works
out-of-the-box on new workstations. Skipped on LXCs / VMs.

Idempotent (`command -v mcp` guard), respects --dry-run, falls back
through brew (Darwin) → dnf → apt for pipx itself if not already
installed. Runs the install as $SUDO_USER (not root) so the binary
lands in the user's pipx env.

This closes one of the "discovered missing dep" gaps from the 2026-05-21
fleet sweep: republic-laptop had pipx-installed homelab CLI but no `mcp`
binary, so `homelab mcp <tool>` died with an instructional message
instead of just working.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

bootstrap.sh

@@ -390,6 +390,36 @@ SSHEOF
     fi
 fi
 
+# -------- mcp CLI install (workstations) --------
+# `homelab mcp <tool>` shells out to the `mcp` python CLI. Install it via
+# pipx for the enrolling user. Skip on LXCs / VMs.
+if [ "$HKIND" != "lxc" ] && [ "$HKIND" != "vm" ]; then
+    if [ "$DRY_RUN" -eq 1 ]; then
+        echo "+ would install 'mcp[cli]' via pipx for the enrolling user"
+    elif command -v mcp >/dev/null 2>&1; then
+        echo "[bootstrap] mcp CLI already on PATH (skip)"
+    else
+        # Make sure pipx is available; OS-specific install.
+        if ! command -v pipx >/dev/null 2>&1; then
+            if [ "$OS" = "Darwin" ] && command -v brew >/dev/null 2>&1; then
+                sudo -u "${SUDO_USER:-$USER}" brew install pipx 2>&1 | tail -2 || true
+            elif command -v dnf >/dev/null 2>&1; then
+                dnf install -y pipx 2>&1 | tail -2 || true
+            elif command -v apt-get >/dev/null 2>&1; then
+                DEBIAN_FRONTEND=noninteractive apt-get install -y pipx 2>&1 | tail -2 || true
+            fi
+        fi
+        if command -v pipx >/dev/null 2>&1; then
+            INVOKING_USER="${SUDO_USER:-$USER}"
+            sudo -u "$INVOKING_USER" -- bash -lc "pipx install 'mcp[cli]'" 2>&1 | tail -3 || true
+            sudo -u "$INVOKING_USER" -- bash -lc "pipx ensurepath" >/dev/null 2>&1 || true
+            echo "[bootstrap] mcp CLI installed for $INVOKING_USER via pipx"
+        else
+            echo "[bootstrap] WARNING: pipx unavailable; install manually: pipx install 'mcp[cli]'" >&2
+        fi
+    fi
+fi
+
 # -------- done --------
 cat <<EOF