P2 slice 8: the viewer's menu, setup, no confinement (D-32)

No Landlock, no seccomp, no helper: isolation is "same_user
(advisory)". The lease socket keeps two intents (close, format-upgrade
consent). The viewer holds the books open while it runs and gains a
Books menu: New books, Back up now, Restore (preview, then confirm),
Close, Connect Claude Code / Codex. New commands `wanderbooks books
back-up` and `wanderbooks connect claude|codex`. The scaffold
(`new`/`init` and its templates) is gone; install.sh needs no sudo.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01T3gXMVt7XJPi6ens1or9Dj

crates/ledger-mcp/src/tools/kept.rs

@@ -237,6 +237,10 @@ pub struct StartOut {
     pub handbook_sections: Vec<SectionOut>,
     /// What to do next, in order.
     pub next_steps: Vec<NextStepOut>,
+    /// How the books are kept from agents: "same_user (advisory)", hidden
+    /// from them in the human's own account, not locked against them
+    /// (plan D-32): reach them only through these tools.
+    pub isolation: String,
 }
 
 /// One setting change.
@@ -894,6 +898,7 @@ impl BooksServer {
                 })
                 .collect(),
             next_steps,
+            isolation: "same_user (advisory)".to_string(),
         };
         // Fit (INVARIANT 4): whole lists if they fit; else summaries go,
         // then the lists shorten from the end, each saying how many more.