feat: install and register csa-skilljar alongside csa-google-workspace

[kurtseifried]

csa-skilljar 0.8.0 went to PyPI today, so DesktopSetup can install it the way it installs Google Workspace. The setup script itself lives in the gated CSA-Plugins repo (#53, merged); this is the wiring.

One list instead of four copied blocks

The three bash scripts and the PowerShell one each fetched exactly one internal setup script by name. They now iterate a list, so a third server is one line rather than four edited functions.

continue, not return — the substantive change

With a single fetch, a script that was absent — not merged yet, or renamed — just ended the function. With two, that same absence would have silently disabled every server listed after it.

Not hypothetical. The first end-to-end run happened before CSA-Plugins#53 merged:

==> csa-google-workspace is ready — ask Claude about a CSA doc.
        (skilljar fetch missed, loop completed cleanly)

Then after merging:

==> csa-google-workspace is ready — ask Claude about a CSA doc.
==> csa-skilljar already current: 0.8.0
==> csa-skilljar already registered with a CSA policy; leaving it as it is

Windows is listed but not yet shipped

windows-ai-tools.ps1 lists csa-skilljar-setup.ps1, which does not exist — only the .sh does. Deliberate: the skip is correct behaviour, and Windows picks Skilljar up automatically the day the .ps1 lands, with no change here.

TODO.md records the gap, because a skip that is correct looks identical to a skip that is a bug — and this one would otherwise stay quiet indefinitely.

Preview announces it

macos-ai-tools.sh's plan gains a Skilljar line. The Google line was added because a plan that omits a step leaves the reader unable to tell whether their server was touched; same reasoning.

Tested for real on macOS

Fresh install	0.0.1 → 0.8.0
Registration	Status: ✔ Connected, CSA_SKILLJAR_PROFILE=parity (read-only)
Idempotent re-run	"already current", "leaving it as it is"
Both setups in sequence, fetched from the gate repo	✅
shellcheck counts	unchanged — 15/1/3 before and after
PowerShell	parses

Note on what gets installed

No Skilljar credential is distributed. Unlike the Google OAuth client — which identifies the app while each person's browser login identifies them — Skilljar's client_credentials means the credential is the identity. The setup script installs the code and registers with the read-only parity profile; without a credential the server still starts and every tool reports its setup step. Full reasoning is in CSA-Plugins#53.