One command from fresh Fedora to the front door

`boot` is the script the README now leads with: curl it, and it installs
git if the machine lacks it, clones the repository to PANAMA_PATH, and
hands off to ./install -- reattaching the terminal first, because a
piped stdin would strand the interview. Deliberately dumb: a curled copy
leaves the repository the moment it runs, so nothing that can drift
lives in it. Re-running is the recovery path: an existing clone is
fast-forwarded, never re-cloned, and a refused fast-forward installs
from what is there rather than stopping mid-repair. All of it pinned by
the boot contract, against stub git and a throwaway clone.

README.md

@@ -3,11 +3,23 @@
 Formerly Sunhat. A personal config for Fedora, with the intention of helping a
 user set up their Fedora system with one command.
 
+```sh
+bash <(curl -fsSL https://git.gbrown.org/gib/Panama/raw/branch/main/boot)
+```
+
+`boot` installs git if the machine lacks it, clones this repository to
+`~/.local/share/Panama` (or `$PANAMA_PATH`), and hands off to `install`. It is
+deliberately small enough to read first, and the same two steps by hand work
+identically:
+
 ```sh
 git clone https://git.gbrown.org/gib/Panama.git ~/.local/share/Panama
 ~/.local/share/Panama/install
 ```
 
+Both are safe to run again: an existing clone is fast-forwarded rather than
+replaced, and `install` is the upgrade path.
+
 `install` asks its questions first and then runs the stages in `setup/scripts/`
 in order, without stopping again:
 
@@ -101,7 +113,7 @@ docs/           Settings reference, and the design specs behind the work
 
 ## Tests
 
-131 of them, under `tests/`. Run the lot, or a subset by pattern:
+132 of them, under `tests/`. Run the lot, or a subset by pattern:
 
 ```sh
 panama test           # everything