feat(cli): add mureo install-desktop for Claude Desktop onboarding

[hyoshi]

Summary

Phase 2-1 of the non-engineer onboarding roadmap. Adds mureo install-desktop to wire mureo into Claude Desktop chat in a single command.

Why

Today, getting mureo running in Claude Desktop chat requires four manual steps that each have their own footgun:

1. Find ~/Library/Application Support/Claude/claude_desktop_config.json
2. Edit JSON by hand (the GUI strips fields like cwd on save)
3. Discover that Claude Desktop ignores the cwd field anyway and the MCP process inherits cwd=/, which is read-only on macOS
4. Write a shell wrapper that cds into the workspace before exec'ing the MCP server

A non-engineer cannot reasonably be expected to do any of those. This command does all four at once.

What it does

Step	Detail
1. Workspace	mkdir -p ~/mureo (or --workspace PATH)
2. Wrapper	Generates ~/.local/bin/mureo-mcp-wrapper.sh with chmod 0o755, paths shlex.quote-d so spaces/metacharacters cannot break the script
3. Backup	Snapshots existing claude_desktop_config.json to <name>.bak.<UTC-microsecond-timestamp> before any mutation
4. Config merge	Adds the mureo MCP entry without clobbering other servers (filesystem, github, ...) or top-level keys (preferences, ...)
5. Atomic write	tempfile + os.fsync + os.replace so a disk-full or power loss mid-write cannot leave Claude Desktop without mcpServers
6. Demo (optional)	--with-demo seasonality-trap seeds the workspace with a demo scenario; validated up-front so a typo cannot leave a half-populated state

Refusal cases

• Non-macOS host (Phase 1 scope; Linux/Windows tracked as follow-up)
• Existing mureo entry without --force
• Corrupt JSON / non-object top-level / non-object mcpServers (refuses rather than silently overwriting hand-edited config)
• Symlinked config (Dropbox/iCloud sync setups) — refuses to follow rather than silently writing through the link
• Unknown --with-demo scenario — raised before any mutation

Flags

--workspace, -w  PATH    Defaults to ~/mureo
--with-demo      TEXT    seasonality-trap | halo-effect | hidden-champion | strategy-drift
--force, -f              Overwrite existing entry (backup is always saved)
--dry-run                Preview; mutates nothing

Test plan

• 22 unit tests in tests/test_desktop_installer.py cover:
  • Fresh install (workspace, wrapper, config dir creation)
  • Existing config preserved (other MCP servers, top-level prefs)
  • Force overwrite + timestamped backup
  • Refusal when mureo entry exists without --force
  • --dry-run mutates nothing
  • Non-macOS refusal
  • --with-demo invokes demo materialise with correct args
  • Unknown demo scenario rejected before any mutation
  • Idempotence including mureo key not duplicated on re-run
  • Corrupt JSON, non-object top-level, non-object mcpServers
  • Permissive handling of {"mcpServers": null}
  • Refusal on symlinked config
  • Wrapper quotes workspace paths containing spaces
• ruff check, black --check, mypy --strict clean on all 4 modified files
• Broader regression run (136 tests across CLI, MCP tools, demo, BYOD) — all green
• Smoke-tested locally: mureo install-desktop --help and --dry-run --force work
• python-reviewer agent ran end-to-end; addressed both CRITICAL findings (shell injection via shlex.quote, non-atomic config write via tempfile + os.replace + symlink refusal) and all HIGH findings

Out of scope

• mureo uninstall-desktop — Phase 2 follow-up PR
• mureo doctor desktop — Phase 2 follow-up PR
• Linux/Windows support — Phase 5 once Phase 2-4 lands
• Skills MCP migration so /daily-check works in Desktop — Phase 3