bin/: add zarf

zarf v0.81.0 (current latest), a single static binary for offline/airgapped
Kubernetes. Both Linux release assets verified to resolve; install is
idempotent via the ~/.local/bin/.versions stamp.

Also drops a stray leading space from install_opencode's argument line.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

README.md

@@ -40,8 +40,9 @@ Already have a clone? Just run it directly:
 - `bin/` — installs userland devops CLIs as self-contained, statically
   linked release binaries into `~/.local/bin`: jq, kubectl, helm, k9s,
   kubectx/kubens, stern, yq, OpenTofu, terragrunt, task (go-task, the
-  Taskfile runner), the 1Password CLI `op` for secrets storage, and the
+  Taskfile runner), the 1Password CLI `op` for secrets storage, the
-  opencode coding agent. kind is installed
+  opencode coding agent, and zarf (DevSecOps for Offline and Airgapped
+  Kubernetes). kind is installed
   only when full (non-rootless) Docker is available — it doesn't work
   against rootless Docker, so it is skipped on Kasm. No sudo, nothing
   outside `$HOME`, so tools persist across Kasm redeploys with no

bin/install.sh

@@ -156,6 +156,19 @@ install_opencode() {
   mark_version opencode "$ver"
 }
 
+# zarf — a DevSecOps tool for Offline and Airgapped Kubernetes (single static binary).
+install_zarf() {
+  ver=v0.81.0
+  have_version zarf "$ver" && { fsay "zarf $ver already installed."; return 0; }
+  case "$DEB" in
+    amd64) _zarf_arch=amd64 ;;
+    *) _zarf_arch=arm64 ;;
+  esac
+  install_raw_bin \
+    "https://github.com/zarf-dev/zarf/releases/download/$ver/zarf_${ver}_Linux_$_zarf_arch" zarf
+  mark_version zarf "$ver"
+}
+
 # task — go-task, the Taskfile.yml task runner. Binary is at the archive root.
 install_task() {
   ver=v3.52.0
@@ -194,5 +207,6 @@ install_task
 install_terragrunt
 install_1p
 install_opencode
+install_zarf
 
 fsay "Done. Tools in $BIN_DIR (added to PATH by zsh/zshrc)."