Make Docker/GitHub CLI/plugins/webapp-testing opt-in extras

[modem7]

Summary

• The script stays a generic "get Claude Code running on a fresh Ubuntu VM" installer; personal opinions (specific plugins, claude-config sync) belong in a separate bootstrap layer, not baked in here.
• Docker, GitHub CLI + SSH/gh auth login, the recommended Claude Code plugin bundle, and the webapp-testing skill + Playwright are now each their own [Y/n] prompt (default yes), asked up front alongside the git identity questions so the rest of the install still runs unattended.
• Declining an extra now actually reflects downstream: settings.json only gets the plugin/marketplace block if the bundle was accepted (and docker/github plugin entries only appear if those tools were installed), the generated ~/project/CLAUDE.md drops the matching sections instead of describing tools that were never installed, and the final summary only lists what's actually there.
• Dropped alwaysThinkingEnabled, MAX_THINKING_TOKENS, and CLAUDE_CODE_MAX_OUTPUT_TOKENS from the generated settings.json — these were personal tuning that had nothing to do with a baseline "make Claude Code work" install.
• Claude Code itself now installs from Anthropic's signed apt repo instead of the curl | bash native installer. The native installer's downloaded binary turned out to hang reproducibly (confirmed via strace: a 99%-CPU busy-spin, not network/entropy/install-script related) on a VM using QEMU's generic "Common KVM processor" CPU model, which lacks AVX/AVX2/RDRAND/BMI1/BMI2/etc. that real or host-passthrough CPUs expose. The apt-installed binary is unaffected on a properly-configured (host-CPU-passthrough) VM, and gets plain apt upgrade claude-code updates instead of a self-updating background process. The script verifies the repo's gpg key fingerprint against the one published in Anthropic's own docs before trusting it.

Test plan

• bash -n syntax check passes
• shellcheck shows no new warnings vs. the pre-change baseline (only pre-existing SC1091/SC2016 info-level notices)
• Manual run-through on a fresh Ubuntu 24.04 box, answering each prompt Y and N to confirm the generated settings.json/CLAUDE.md match the choices (see PR comments for the opt-in/opt-out pass and the full end-to-end pass)

[modem7]

Ran both manual test-plan passes on a fresh Ubuntu 24.04 KVM VM.

Run 1 — Docker=Y, plugin bundle=Y, webapp-testing=Y, GitHub=N:

• Docker installed and configured correctly (skipped GitHub CLI/SSH as expected)
• settings.json plugin bundle correctly includes docker but excludes github (since GitHub setup was declined)
• Generated CLAUDE.md has Docker Usage / Installed Plugins / Installed Skills sections, no GitHub Access section
• Final summary step-numbering correctly skips the GitHub step with no gap
• Exit 0

Run 2 — everything declined (Docker/plugins/webapp-testing/GitHub all N):

• All four "declined" skip messages printed, none of the corresponding install steps ran
• settings.json is permissions-only — no enabledPlugins/extraKnownMarketplaces block at all
• Generated CLAUDE.md omits Docker/GitHub/Plugins/Skills sections entirely
• Summary correctly shows "Plugins: none (declined)" and omits the Skills/Docker/GitHub lines
• Exit 0

Minor cosmetic-only nit: when a tools-list line is omitted (e.g. the Docker bullet under "Available Tools"), it leaves one blank line in the generated markdown rather than closing the gap. Harmless, not worth the added complexity to fix.

Unrelated finding, not caused by this PR: the official curl -fsSL https://claude.ai/install.sh | bash step hung reproducibly at ~99% CPU on this particular VM (confirmed with strace — looks like a busy-loop, not network/IO-bound; ruled out a broken clocksource, which is the usual suspect on nested KVM). Verified with a throwaway test harness that skipped just that one unchanged line so the rest of the script (the actual diff) could be validated. Worth a separate look at some point, but out of scope here.

Test plan checkbox updated — marking the manual run-through done.

[modem7]

Ran the full, unmodified script end-to-end on a fresh Ubuntu 24.04 VM (real host-CPU-passthrough KVM, so the apt-installed claude binary runs correctly — see below), answering Y to every prompt (git identity, GitHub, Docker, plugin bundle, webapp-testing) to exercise every step in one pass.

Every step ran and completed, exit 0:

>>> Generating locale (en_GB.UTF-8)...
>>> Updating system...
>>> Installing core packages...
>>> Installing build tools & dev libraries...
>>> Installing search & productivity tools...
>>> Installing database clients...
>>> Installing Node.js 22.x LTS...
>>> Installing global npm packages...
>>> Installing Go...
>>> Installing Rust (as your user, no sudo needed)...
>>> Installing Docker...
>>> Adding claude to the docker group (run docker without sudo)...
>>> Setting up Git identity...
>>> Installing GitHub CLI (gh)...
>>> Setting up SSH key for GitHub...
>>> Installing Claude Code (via Anthropic's signed apt repo)...
>>> Configuring Claude Code permissions + plugins...
>>> Enabling Claude Code Remote Control auto-start...
>>> Setting up ~/project directory...
>>> Installing webapp-testing skill (from anthropics/skills)...
>>> Installing Playwright for webapp-testing skill...
>>> Setting up shell environment (bash + zsh if present)...
>>> Setting up weekly auto-update cron...
>>> Cleaning up...

Only warning printed was the expected one (docker group needs a fresh login/newgrp). Post-run verification:

• claude --version → 2.1.212 (Claude Code), instant, no hang
• claude doctor → clean, no installation issues
• docker run hello-world (via sg docker) → Hello from Docker!
• node --version → v22.23.2, go version → go1.26.5, rustc --version → 1.97.1, python3 --version → 3.12.3, rg --version → 14.1.0
• ~/.claude/settings.json → valid JSON, all 9 plugins present (including docker and github, both accepted this run)
• ~/project/CLAUDE.md → all conditional sections present (Docker Usage, GitHub Access, Installed Plugins, Installed Skills)
• webapp-testing skill + Playwright chromium/headless-shell/ffmpeg all present under ~/.claude/skills/webapp-testing and ~/.cache/ms-playwright
• Final summary correctly numbered the "Next steps" 1-5 (Docker + GitHub steps both present since both were accepted) and listed the right plugin/skill/tool set

Combined with the earlier decline-everything and partial-accept passes already in the first comment, all four opt-in extras (Docker, GitHub CLI, plugin bundle, webapp-testing) and the new apt-based Claude Code install have now been verified both individually and in a single full run.