chore: add cloud workspace setup

[GeneralPawz]

Cloud sessions can now use this setup command from the repository root:

#!/usr/bin/env bash
set -euo pipefail
exec ./scripts/cloud-setup.sh

The executable script prepares an Ubuntu/Debian image with root or passwordless sudo, installs the repository tools, and warms dependency caches. Installed commands remain available in later shells. Tool choices follow the repository CI, with wasm-bindgen read from Cargo.lock where needed. Setup is rerunnable and stops on required dependency failures.

docs/cloud-setup.md describes supported images and network requirements. The new CI workflow runs isolated command-flow tests plus a real Ubuntu bootstrap smoke check, including a command in a subsequent shell.

Validation:

• bash -n scripts/cloud-setup.sh: exit 0.
• python3 scripts/test-cloud-setup.py: PASS (14 cases; workspace-specific cases are skipped when inapplicable).
• git diff --cached --check: exit 0.
• scripts/gate.sh: exit 0.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f040fb00cf

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve proxy variables across sudo

When a non-root cloud image reaches package repositories through environment-only HTTP_PROXY/HTTPS_PROXY settings, this command runs through sudo -n without preserving those variables, so apt-get update receives sudo's sanitized environment and setup fails before installing anything, contrary to the proxy-inheritance promise in docs/cloud-setup.md. sudo --help explicitly defines -E/--preserve-env as preserving the user's environment; preserve the relevant proxy variables or pass them explicitly to the privileged command.

Useful? React with 👍 / 👎.