Add Render CLI to setup and doctor (#1)

## Summary
- Installs the Render CLI across macOS (brew tap `render-oss/render`),
Ubuntu (GitHub release zip), and Arch (`render-cli-bin` via yay/paru)
- Adds a matching doctor check and lists the new tool in the README

## Test plan
- [x] `bash doctor.sh` reports Render CLI as installed on Arch
- [ ] Re-run `setup.sh` on a machine without `render` to confirm the
install path on each OS

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: mhfs

README.md

@@ -21,6 +21,7 @@ Bootstraps a developer machine with the baseline tools required to work on Trust
 - **Colima** — container runtime for macOS (macOS only)
 - **AWS CLI** — Amazon Web Services CLI (no auth configured)
 - **AWS VPN Client** — VPN client for AWS
+- **Render CLI** — Render.com CLI
 - **Private registries** — Bundler and Yarn credentials for private packages
 
 ## Quick start

doctor.sh

@@ -32,6 +32,7 @@ else
   SETUP_REF="${SETUP_REF:-main}"
   DOCTOR_TMPDIR=""
 
+  # shellcheck disable=SC2317 # Invoked indirectly via trap
   cleanup_tmp() { [ -n "$DOCTOR_TMPDIR" ] && rm -rf "$DOCTOR_TMPDIR"; }
   trap cleanup_tmp EXIT
 
@@ -132,6 +133,9 @@ source "$SCRIPT_DIR/lib/docker_doctor.sh"
 # shellcheck source=lib/aws_doctor.sh
 source "$SCRIPT_DIR/lib/aws_doctor.sh"
 
+# shellcheck source=lib/render_doctor.sh
+source "$SCRIPT_DIR/lib/render_doctor.sh"
+
 # shellcheck source=lib/registries_doctor.sh
 source "$SCRIPT_DIR/lib/registries_doctor.sh"
 

lib/render_doctor.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+#
+# Doctor check: Render CLI.
+# Sourced by doctor.sh — do not execute directly.
+# Requires: lib/common.sh, doctor helpers (check_pass, check_fail, check_cmd)
+
+fmt_header "Render CLI"
+
+check_cmd "render" "render"
+
+if cmd_exists render; then
+  version_output="$(render --version 2>&1 | head -1)"
+  check_pass "render reports version: $version_output"
+fi

lib/render_setup.sh

@@ -0,0 +1,56 @@
+#!/bin/bash
+#
+# Render CLI setup.
+# Sourced by setup.sh — do not execute directly.
+# Requires: lib/common.sh
+
+fmt_header "Render CLI"
+
+if cmd_exists render; then
+  fmt_ok "render already installed ($(render --version 2>&1 | head -1))"
+else
+  fmt_install "Render CLI"
+  case "$OS" in
+    macos)
+      brew install render-oss/render/render
+      ;;
+    ubuntu)
+      render_arch="amd64"
+      case "$(uname -m)" in
+        aarch64|arm64) render_arch="arm64" ;;
+        armv7l|armv6l) render_arch="arm" ;;
+        i386|i686)     render_arch="386" ;;
+      esac
+
+      if ! cmd_exists unzip; then
+        sudo apt-get install -y -qq unzip
+      fi
+
+      render_tmp="$(mktemp -d)"
+      render_url="$(curl -fsSL https://api.github.com/repos/render-oss/cli/releases/latest \
+        | grep -oE "\"browser_download_url\": \"[^\"]*cli_[0-9.]+_linux_${render_arch}\.zip\"" \
+        | head -1 | cut -d'"' -f4)"
+
+      if [ -z "$render_url" ]; then
+        echo "  ERROR: Could not resolve Render CLI release for linux/${render_arch}."
+        exit 1
+      fi
+
+      curl -fsSL "$render_url" -o "$render_tmp/render.zip"
+      unzip -qo "$render_tmp/render.zip" -d "$render_tmp"
+      render_bin="$(find "$render_tmp" -maxdepth 1 -type f -name 'cli_v*' | head -1)"
+      sudo install -m 0755 "$render_bin" /usr/local/bin/render
+      rm -rf "$render_tmp"
+      ;;
+    arch)
+      if cmd_exists yay; then
+        yay -S --noconfirm render-cli-bin
+      elif cmd_exists paru; then
+        paru -S --noconfirm render-cli-bin
+      else
+        echo "  WARNING: No AUR helper found (yay/paru)."
+        echo "  Install render-cli-bin manually from AUR."
+      fi
+      ;;
+  esac
+fi

setup.sh

@@ -146,6 +146,9 @@ source "$SCRIPT_DIR/lib/docker_setup.sh"
 # shellcheck source=lib/aws_setup.sh
 source "$SCRIPT_DIR/lib/aws_setup.sh"
 
+# shellcheck source=lib/render_setup.sh
+source "$SCRIPT_DIR/lib/render_setup.sh"
+
 # shellcheck source=lib/registries_setup.sh
 source "$SCRIPT_DIR/lib/registries_setup.sh"