feat: add version checking and install manifest tracking

Add minimum version validation for all dependencies across local and
remote machines (jq>=1.6, curl>=7.70, git>=2.30, docker>=20.0,
compose>=2.0, shellcheck>=0.8, gh>=2.0). Setup scripts now record
every install action to .manifests/<host>.manifest files, enabling
full rollback via setup/cleanup.sh. teardown_all.sh gains --cleanup
flag to chain prerequisite removal after phase teardowns.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

CLAUDE.md

@@ -35,12 +35,24 @@ backup/               # Backup and restore scripts
 
 ## Key Commands
 - `setup/configure_env.sh` — Interactive .env setup wizard
+- `setup/cleanup.sh` — Reverse everything setup scripts installed (reads .manifests/)
 - `preflight.sh` — Validate everything before running phases
 - `run_all.sh` — Execute all phases sequentially
-- `teardown_all.sh` — Reverse teardown
+- `teardown_all.sh` — Reverse teardown (add `--cleanup` to also uninstall prerequisites)
 - `manage_runner.sh add|remove|list` — Dynamic runner management
 
+## Version Checking
+Setup scripts and preflight validate minimum versions for all tools:
+- Local: jq>=1.6, curl>=7.70, git>=2.30, shellcheck>=0.8, gh>=2.0
+- Remote: docker>=20.0, docker-compose>=2.0, jq>=1.6
+
+## Install Manifests
+Setup scripts record every install action to `.manifests/<host>.manifest`.
+`setup/cleanup.sh` reads these manifests to fully reverse setup actions.
+Useful for cleaning machines after testing or migrating to new servers.
+
 ## Sensitive Files (never commit)
 - `.env` — contains passwords, tokens, IPs
 - `runners.conf` — contains server IPs and paths
+- `.manifests/` — machine-specific install state
 - `*.pem`, `*.key`, `*.crt` — SSL certificates