feat(workspace): add explicit setup commands

[christso]

Summary

• add an optional ordered setup list to workspace.yaml, with string shorthand and object entries using run, platforms, and architectures
• add explicit allagents workspace setup execution with platform/architecture selection, command display, sequential execution, deterministic JSON output, and first-failure handling
• keep setup commands inert during init, update, and sync because remote workspace templates are untrusted
• configure the engineering example to install Herdr with its official Unix installer on Linux/macOS and its official PowerShell installer on Windows
• sync the official herdrdev/herdr skill

Configuration

setup:
  - run: curl -fsSL https://herdr.dev/install.sh | sh
    platforms: [linux, darwin]
  - run: 'powershell -ExecutionPolicy Bypass -c "irm https://herdr.dev/install.ps1 | iex"'
    platforms: [win32]

Architecture selectors use Node process.arch names. Herdr's platform installers already detect x64 versus ARM, so the example does not need architecture-specific commands.

Verification

• bun test — 1488 passed, 5 skipped, 0 failed
• bun run typecheck
• bun run lint
• bun run build
• built-CLI smoke on Linux/x64: unconditional and matching setup entries executed; nonmatching platform and architecture entries were reported as skipped and produced no files
• parsed the engineering example through WorkspaceConfigSchema; Linux/macOS and Windows installer entries retained the expected commands and selectors
• independent security review found no platform-filter or trust-boundary findings

Security

Setup commands execute only after the user explicitly invokes allagents workspace setup. Creating a workspace from a remote template and ordinary synchronization never execute them. Unknown platform/architecture values fail validation; nonmatching entries are skipped before process creation.

[cloudflare-workers-and-pages]

Deploying allagents with    Cloudflare Pages

Latest commit:	1e6dbfc
Status:	✅  Deploy successful!
Preview URL:	https://0c8e3c54.allagents.pages.dev
Branch Preview URL:	https://feat-herdr-workspace-tooling.allagents.pages.dev

View logs