bootstrap: stop one failed tool from killing the whole run

On a minimal Debian/RHEL image neither python3 nor unzip is present.
lib/fetch.sh's install_zip_bin needs one of them, so the 1Password CLI
install failed -- and under `set -eu` that killed bin/install.sh outright.
install_1p sits immediately before install_opencode and install_zarf, so
neither installed; bin/install.sh's non-zero exit then aborted bootstrap.sh,
so node/ (npx) and ansible/ (python3) never ran either.

Net effect on a fresh box: no opencode, no npx for the MCP servers, and no
python3 for model discovery. It presented as "opencode has no models or
skills". Reproduced in a clean debian:13 container.

Two fixes:

  - bin/install.sh: each tool now installs via try(), which warns and
    continues instead of aborting, and reports a summary of what failed. One
    optional CLI is not worth the rest of the bootstrap. The subshell
    re-enables set -e so a failed download can't fall through to mark_version
    and stamp a version that was never installed.

  - bootstrap.sh: ensure python3 before bin/ runs. It is a hard dependency,
    not an extra -- lib/fetch.sh needs it (or unzip) for .zip assets, and
    mcp-config/sync.sh needs it to inject discovered models.

Verified end to end on fresh debian:13: bootstrap completes, opencode/zarf/
op/npx/node/python3 all present, and opencode resolves all 3 covert-gpt
models.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

bin/install.sh

@@ -189,24 +189,48 @@ install_terragrunt() {
   mark_version terragrunt "$ver"
 }
 
-install_jq
-install_kubectl
-install_helm
-install_k9s
+# try <install_fn> — run one tool's installer; on failure, warn and keep going.
+#
+# WHY: these installs used to be bare calls, so under `set -eu` the FIRST
+# failure killed this script -- and its non-zero exit then aborted bootstrap.sh
+# itself, so every later module (node/, ansible/) silently never ran. A single
+# tool whose release asset moved could leave a box with no opencode, no npx and
+# no python3. One optional CLI is not worth the whole bootstrap.
+#
+# The subshell re-enables `set -e` inside itself (it is disabled for a command
+# being tested by `if`), so a failed download still aborts that tool's function
+# before mark_version stamps a version that was never installed.
+FAILED=""
+try() {
+  if ( set -e; "$1" ); then return 0; fi
+  FAILED="$FAILED ${1#install_}"
+  fsay "WARNING: ${1#install_} failed to install; continuing."
+}
+
+try install_jq
+try install_kubectl
+try install_helm
+try install_k9s
 if docker_full_available; then
-  install_kind
+  try install_kind
 else
   fsay "Skipping kind: full (non-rootless) Docker not available."
 fi
-install_kubectx
-install_kubens
-install_stern
-install_yq
-install_tofu
-install_task
-install_terragrunt
-install_1p
-install_opencode
-install_zarf
+try install_kubectx
+try install_kubens
+try install_stern
+try install_yq
+try install_tofu
+try install_task
+try install_terragrunt
+try install_1p
+try install_opencode
+try install_zarf
 
-fsay "Done. Tools in $BIN_DIR (added to PATH by zsh/zshrc)."
+if [ -n "$FAILED" ]; then
+  fsay ""
+  fsay "WARNING: these tools did NOT install:$FAILED"
+  fsay "Everything else is in $BIN_DIR. Fix the cause and re-run bin/install.sh."
+else
+  fsay "Done. Tools in $BIN_DIR (added to PATH by zsh/zshrc)."
+fi