workstation: roster source-of-truth + host package manifest [ci skip]

roster.yaml is the single source of truth for the devvm Workstation lifecycle (os_user -> authentik_user/k8s_user/tier/namespaces); wizard listed as admin so the regenerated ttyd-map/dispatch never drops his instance. packages.txt is the declarative apt toolset (non-apt tools — node/claude-code/kubectl/vault/kubelogin — noted with their real install paths; the apt pkg named 'kubelogin' is the wrong Azure tool).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/workstation/packages.txt

@@ -0,0 +1,26 @@
+# Declarative host toolset for the devvm Workstation (apt packages, one per line).
+# Consumed by setup-devvm.sh:  apt-get install -y $(grep -vE '^\s*(#|$)' packages.txt)
+# Comments (#) and blank lines are ignored. Tools NOT in the standard apt repos
+# are listed below as comments with their real install path (handled explicitly
+# in setup-devvm.sh) so this manifest stays a safe argument to `apt-get install`.
+git
+zsh
+tmux
+ripgrep
+fd-find
+jq
+curl
+ca-certificates
+python3
+python3-yaml
+python3-pip
+podman
+
+# --- installed by setup-devvm.sh via NON-apt paths (not apt-installable) ---
+# nodejs + npm                -> NodeSource repo (claude-code needs node >= 18; distro nodejs is too old)
+# @anthropic-ai/claude-code   -> npm install -g
+# kubectl                     -> k8s apt repo OR pinned binary (already present on devvm)
+# vault                       -> HashiCorp apt repo OR pinned binary (already present on devvm)
+# kubelogin (kubectl oidc-login) -> `kubectl krew install oidc-login` or int128/kubelogin release.
+#                                NOTE: the apt package literally named "kubelogin" is the AZURE
+#                                tool, NOT the OIDC one we need -- do not apt-install it.