Add bin/setup to prepare a repository host

The sync guard could not read the repository database because bsdtar was not
installed on the host, and the first fix was to parse around its absence. The
better answer is for the host to have what the tooling needs: libarchive ships
the library pacman links against without necessarily installing the binary, so
bsdtar being present was an assumption, not a fact.

bin/setup installs the dependencies, enables Docker, creates the state
directory, and installs and enables the release timers -- the steps the README
previously listed by hand. It is idempotent and takes --check to report without
changing anything. Signing credentials and the rclone remote hold secrets, so
it reports on those rather than creating them.

sync-repo goes back to reading the database with bsdtar alone, and says to run
bin/setup when it is missing.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

bin/repo

@@ -60,6 +60,7 @@ show_usage() {
   echo "  sync        Sync repository to remote"
   echo "  push        Upload local builds to the repository host and publish them there"
   echo "  deploy      Build locally, then push: one command from a build machine"
+  echo "  setup       Install everything the repository host needs"
   echo ""
   echo "Typical workflows:"
   echo "  $0 release                  # Complete release workflow"
@@ -135,6 +136,10 @@ deploy)
   "$SCRIPT_DIR/deploy" "$@" 2>&1 | tee "$LOG_FILE"
   exit ${PIPESTATUS[0]}
   ;;
+setup)
+  "$SCRIPT_DIR/setup" "$@" 2>&1 | tee "$LOG_FILE"
+  exit ${PIPESTATUS[0]}
+  ;;
 -h | --help | help)
   show_usage
   ;;