fix(install): bootstrap relay config + correct agent auth command

- Add config bootstrap step: set callback_server and keyring_backend
  after binary install so fresh installs work without credentials.json
- Fix agent bootstrap instructions: use `wk auth manage --print-url`
  instead of `wk auth add --headless` which requires local credentials
- Update setup.md skill with correct agent auth pattern

Author: automagik-genie

install.sh

@@ -279,6 +279,13 @@ else
     info "Binary unchanged at ${TARGET}"
 fi
 
+# ---------------------------------------------------------------------------
+# Bootstrap config (relay auth — no GCP setup needed)
+# ---------------------------------------------------------------------------
+"$TARGET" config set callback_server https://auth.automagik.dev 2>/dev/null
+"$TARGET" config set keyring_backend file 2>/dev/null
+ok "Config: relay auth via auth.automagik.dev"
+
 # ---------------------------------------------------------------------------
 # Plugin download and install
 # ---------------------------------------------------------------------------
@@ -414,9 +421,9 @@ if [ ! -t 0 ]; then
     printf "No GCP setup needed — auth runs through https://auth.automagik.dev.\n"
     printf "\n"
     printf "Next steps:\n"
-    printf "  1. wk auth status                        → check existing accounts\n"
-    printf "  2. wk auth add EMAIL --headless --no-input  → auth (prints URL for user)\n"
-    printf "  3. wk gmail search 'newer_than:1d' --json   → first query\n"
+    printf "  1. wk auth status                              → check existing accounts\n"
+    printf "  2. wk auth manage --print-url --no-input       → prints auth URL for user\n"
+    printf "  3. wk gmail search 'newer_than:1d' --json      → first query\n"
     printf "\n"
     printf "Available services: Gmail, Calendar, Drive, Sheets, Docs, Slides,\n"
     printf "                    Chat, Classroom, Tasks, Contacts, Keep, Forms, AppScript\n"

plugins/workit/skills/setup.md

@@ -101,7 +101,7 @@ wk auth service-account unset
 
 ## 8) Recommended pattern in agents
 1. `wk auth status` — check if account already exists
-2. If not: `wk auth add user@example.com --headless --no-input` and surface the URL
+2. If not: `wk auth manage --print-url --no-input` — prints auth URL for user to open
 3. `wk auth services` — verify services are authorized
 4. Read operations: add `--read-only`
 5. Write operations: `--dry-run` first, then without after confirmation