bin/repo becomes a remote control: forward host-tree commands over ssh

With a repository host configured (OMARCHY_REPO_HOST / .repo-host), release,
build, sign, promote, update, clean, advance, bootstrap-rc, remove, sync, and
migrate exec on the host over ssh — same code, run where the published tree
lives, after sourcing the host credentials and a --ff-only pull. --local
forces local execution. list/push/deploy/setup never forward. The host itself
has no .repo-host, so ssh'd-in manual use is unchanged. omarchy-release's
advance now rides the same forwarding (one code path), and --host exports
OMARCHY_REPO_HOST so child bin/repo calls follow it.

This closes the gap where bootstrap-rc ran against a workstation's stale
local tree despite .repo-host being set.

bin/repo

@@ -11,6 +11,52 @@ BUILD_ROOT=$(realpath "$SCRIPT_DIR/..")
 # Source common functions
 source "$BUILD_ROOT/helpers/message-helpers.sh"
 source "$BUILD_ROOT/helpers/paths.sh"
+source "$BUILD_ROOT/helpers/host-helpers.sh"
+
+# --- remote control ----------------------------------------------------------
+#
+# With a repository host configured (OMARCHY_REPO_HOST or .repo-host), commands
+# that operate on the published tree run ON the host over ssh — the exact same
+# code, executed where the tree lives. This checkout is the remote control.
+# Pass --local to force local execution. The host itself configures no
+# .repo-host, so on it every command runs locally, ssh'd in or not.
+#
+# Local-machine workflows (list, push, deploy, setup) never forward: push and
+# deploy exist precisely to move local builds TO the host.
+FORWARDABLE=" release build sign promote update clean migrate advance bootstrap-rc remove sync "
+
+LOCAL_OVERRIDE=false
+STRIPPED_ARGS=()
+for arg in "$@"; do
+  if [[ "$arg" == "--local" ]]; then
+    LOCAL_OVERRIDE=true
+  else
+    STRIPPED_ARGS+=("$arg")
+  fi
+done
+set -- "${STRIPPED_ARGS[@]}"
+
+maybe_forward_to_host() {
+  local cmd="${1:-}"
+  shift || true
+  [[ "$LOCAL_OVERRIDE" == true ]] && return 0
+  [[ "$FORWARDABLE" == *" $cmd "* ]] || return 0
+  local host
+  host=$(resolve_repo_host "") || return 0
+
+  local quoted="" a
+  for a in "$@"; do quoted+=" $(printf '%q' "$a")"; done
+
+  # A tty makes the remote confirmation prompts (production sync, etc.) work;
+  # without one locally, run non-interactively.
+  local tty_flag=""
+  [[ -t 0 && -t 1 ]] && tty_flag="-t"
+
+  print_info "Repository host configured — running on $host (pass --local to run here)"
+  exec ssh $tty_flag "$host" "source /root/.omarchy/build-credentials 2>/dev/null; cd /root/omarchy-pkgs && git pull --ff-only && exec bin/repo $cmd$quoted"
+}
+
+maybe_forward_to_host "$@"
 
 # Extract mirror from arguments for log naming (before args are shifted)
 LOG_MIRROR=""
@@ -74,6 +120,11 @@ show_usage() {
   echo "  $0 update"
   echo "  $0 sync pkgs.omarchy.org/x86_64"
   echo ""
+  echo "Remote control: when a repository host is configured (OMARCHY_REPO_HOST"
+  echo "or .repo-host — any ssh destination), the commands above except list,"
+  echo "push, deploy, and setup run ON the host over ssh. Pass --local to force"
+  echo "execution on this machine instead."
+  echo ""
   echo "For command-specific help, use:"
   echo "  $0 <command> --help"
   exit 0