setup-agent-guardlisted

# Setup Agent Guard Make Agent Guard operational without silently changing the machine. Diagnose first, request approval before package-manager or download actions, and finish with a real smoke test. ## Workflow 1. Resolve the Agent Guard executable without confusing the plugin with a standalone install. - First use the plugin binary two directories above this skill: `../../bin/agent-guard` relative to this `SKILL.md` directory. - Resolve the path from the skill directory, confirm that it is executable, and use it for every plugin diagnosis and smoke test. - Separately inspect `command -v agent-guard`, if present. Compare its `version` with the plugin binary and report version drift, but do not substitute it for the plugin binary or modify the standalone installation without explicit approval. - Only fall back to `command -v agent-guard` when the plugin-relative binary is unavailable, and clearly state that plugin-local verification could not be completed. - Do not install a second copy of Agent Guard merely to get a command on `PATH`. 2. Run the read-only diagnosis: ```sh "<agent-guard-bin>" setup ``` 3. If `jq` is missing, identify the available system package manager and show the exact install command. Ask for explicit user approval before running it. Do not use `sudo` unless the user explicitly approves elevated installation. 4. If `gitleaks` is missing, prefer Agent Guard's private, checksum-pinned installer: - Determine the target OS an