Add ~/Work directory and seed devsetup clone

Create ~/Work at the end of setup and clone devsetup into it as a
convenience for engineers who want to contribute. This does not affect
how setup.sh runs — it still executes via curl|bash from GitHub.

Provide GH_TOKEN in CI so gh auth and the clone step work.

Author: mhfs

.github/workflows/ci.yml

@@ -26,6 +26,7 @@ jobs:
         run: bash setup.sh
         env:
           CI: "true"
+          GH_TOKEN: ${{ github.token }}
 
       - name: Install bats
         run: sudo apt-get install -y -qq bats

setup.sh

@@ -410,6 +410,27 @@ fmt_header "Migrations"
 
 run_migrations "$SCRIPT_DIR"
 
+# ---------------------------------------------------------------------------
+# Work directory
+# ---------------------------------------------------------------------------
+
+WORK_DIR="$HOME/Work"
+DEVSETUP_DIR="$WORK_DIR/devsetup"
+
+fmt_header "Work Directory"
+
+mkdir -p "$WORK_DIR"
+fmt_ok "$WORK_DIR ready"
+
+if [ -d "$DEVSETUP_DIR/.git" ]; then
+  fmt_ok "devsetup already at $DEVSETUP_DIR"
+elif gh auth status > /dev/null 2>&1; then
+  fmt_install "Cloning devsetup to $DEVSETUP_DIR"
+  gh repo clone "${DEVSETUP_REPO:-trusted/devsetup}" "$DEVSETUP_DIR" -- --quiet
+else
+  echo "  Skipping devsetup clone (gh not authenticated)."
+fi
+
 # ---------------------------------------------------------------------------
 # Done
 # ---------------------------------------------------------------------------
@@ -419,6 +440,6 @@ echo "= Trusted Dev Setup Complete ="
 echo ""
 echo "Next steps:"
 echo "  1. Open a new terminal (or run: source ~/.zshrc)"
-echo "  2. Clone a project:  gh repo clone trusted/<repo-name>"
+echo "  2. Clone a project:  cd ~/Work && gh repo clone trusted/<repo-name>"
 echo "  3. Run project setup: cd <repo-name> && bin/setup"
 echo ""

test/setup_test.bats

@@ -91,3 +91,19 @@
 @test "migration state directory exists" {
   [ -d "$HOME/.local/state/trusted/devsetup/migrations" ]
 }
+
+# ---------------------------------------------------------------------------
+# Work directory
+# ---------------------------------------------------------------------------
+
+@test "~/Work directory exists" {
+  [ -d "$HOME/Work" ]
+}
+
+@test "devsetup is cloned to ~/Work/devsetup" {
+  [ -d "$HOME/Work/devsetup/.git" ]
+}
+
+@test "~/Work/devsetup contains setup.sh" {
+  [ -f "$HOME/Work/devsetup/setup.sh" ]
+}