P2 slice 8: the viewer's menu, setup, no confinement (D-32)

No Landlock, no seccomp, no helper: isolation is "same_user
(advisory)". The lease socket keeps two intents (close, format-upgrade
consent). The viewer holds the books open while it runs and gains a
Books menu: New books, Back up now, Restore (preview, then confirm),
Close, Connect Claude Code / Codex. New commands `wanderbooks books
back-up` and `wanderbooks connect claude|codex`. The scaffold
(`new`/`init` and its templates) is gone; install.sh needs no sudo.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T3gXMVt7XJPi6ens1or9Dj

crates/ledger-cli/tests/one_executable.rs

@@ -150,6 +150,20 @@ fn a_mode_refuses_what_it_does_not_know() {
     assert_eq!(out.status.code(), Some(2), "{out:?}");
 }
 
+#[test]
+fn the_books_folder_scaffold_is_gone_and_says_so() {
+    for gone in ["new", "init"] {
+        let out = wanderbooks().args([gone, "acme"]).output().unwrap();
+        assert_eq!(out.status.code(), Some(2), "{gone}: {out:?}");
+        let err = String::from_utf8_lossy(&out.stderr);
+        assert!(
+            err.contains(&format!("`wanderbooks {gone}` is gone")),
+            "{err}"
+        );
+        assert!(err.contains("wanderbooks books create ID"), "{err}");
+    }
+}
+
 #[test]
 fn a_mode_comes_first() {
     for mode in ["gui", "dev-stdio", "server"] {