docs: inventory the software setup.sh installs

Lists every apt package, cargo tool, and install-script binary with its
upstream, grouped by how it arrives — the three build deps are separated
out since they exist only to compile the cargo tools and nothing uses them
at runtime, and rustup is placed with the tools that force it rather than
listed as a peer.

Records the reasons that are invisible from the package list: bat's binary
is batcat on Ubuntu so the cat alias depends on it, jq backs the Claude
statusline, and rustup uses --no-modify-path because conf.d/rustup.fish
already sources cargo's env.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -29,6 +29,66 @@ Expect **10–20 minutes**: atuin, eza, macchina and oxker are built from source
 trade for matching the currently-running versions exactly rather than taking
 whatever apt ships.
 
+## What gets installed
+
+Everything `setup.sh` puts on the box, and where it comes from.
+
+### apt packages
+
+| Package | What for | Upstream |
+|---|---|---|
+| `fish` | the shell itself; `setup.sh` `chsh`es to it | [fish-shell/fish-shell](https://github.com/fish-shell/fish-shell) |
+| `bat` | binary is **`batcat`** on Ubuntu; `config.fish` aliases `cat` to it | [sharkdp/bat](https://github.com/sharkdp/bat) |
+| `ripgrep` | `rg` | [BurntSushi/ripgrep](https://github.com/BurntSushi/ripgrep) |
+| `jq` | required by `statusline-command.sh` | [jqlang/jq](https://github.com/jqlang/jq) |
+| `git` | chezmoi clones the source repo with it | [git/git](https://github.com/git/git) |
+| `curl` | fetches the rustup / starship / chezmoi installers | [curl/curl](https://github.com/curl/curl) |
+| `nano` | `$EDITOR`; the `nanox` alias forces `TERM=xterm-256color` under Ghostty | [nano-editor.org](https://www.nano-editor.org/) |
+| `build-essential` | cc/linker — cargo builds need it | [GNU GCC](https://gcc.gnu.org/) |
+| `pkg-config` | build dep for the cargo tools | [pkg-config](https://gitlab.freedesktop.org/pkg-config/pkg-config) |
+| `libssl-dev` | OpenSSL headers — atuin links against them | [openssl/openssl](https://github.com/openssl/openssl) |
+
+The last three exist only to compile the cargo tools below. Nothing uses them at
+runtime.
+
+### Built from source with `cargo install --locked`
+
+| Tool | What for | Upstream |
+|---|---|---|
+| `atuin` | shell history w/ sync + encryption | [atuinsh/atuin](https://github.com/atuinsh/atuin) |
+| `eza` | `ls` replacement; backs the `l` / `ll` / `lt` / `la` aliases | [eza-community/eza](https://github.com/eza-community/eza) |
+| `macchina` | the banner `config.fish` prints on interactive start | [Macchina-CLI/macchina](https://github.com/Macchina-CLI/macchina) |
+| `oxker` | terminal Docker container UI | [mrjackwills/oxker](https://github.com/mrjackwills/oxker) |
+
+This is the slow part — **10–20 minutes cold**. Built from source deliberately, to
+match the versions running on the origin box rather than whatever apt ships. That
+makes the rust toolchain a mandatory build dependency:
+
+| Tool | What for | Upstream |
+|---|---|---|
+| `rustup` + cargo | toolchain for the four tools above | [rust-lang/rustup](https://github.com/rust-lang/rustup) |
+
+Installed via `sh.rustup.rs` with `--no-modify-path` — `conf.d/rustup.fish`
+already sources `~/.cargo/env.fish`, and the installer would otherwise add a
+second PATH edit. Lands in `~/.cargo`, owned by the user, not root.
+
+### Installed via upstream install scripts
+
+| Tool | Where it lands | Upstream |
+|---|---|---|
+| `starship` | `/usr/local/bin` (root) | [starship/starship](https://github.com/starship/starship) |
+| `chezmoi` | `~/.local/bin` (user) | [twpayne/chezmoi](https://github.com/twpayne/chezmoi) |
+
+Both are `curl … | sh` from the projects' own domains (`starship.rs`,
+`get.chezmoi.io`).
+
+### Not installed here
+
+`fnm` (node) and `dtop`/opencode are out of scope — their own installers write
+`conf.d/fnm.fish` and `conf.d/dtop.env.fish`, which are `.chezmoiignore`d.
+`config.fish` adds `~/.opencode/bin` to `PATH` only if that directory already
+exists.
+
 ## chezmoi on another VPS
 
 `setup.sh` already does all of this. Use this path only when you want the dotfiles