Install pandoc as a base dependency

[robobryce]

What & why

install_base_deps installs the apt-get base deps a bootstrapped host needs (curl, python3, git, tar, gawk, ripgrep, sudo, ca-certificates), but not pandoc — yet a plugin the bootstrap installs needs it at runtime.

agent_plugins.txt installs the autocuda marketplace, whose report skills (report-cost, report-optimization, report-behavior, report-skill, report-reward-hacking) all finish by rendering their markdown report to HTML via autocuda report html, which shells out to pandoc. The CLI has no fallback conversion path — when pandoc is absent it exits with:

error: pandoc not installed. Install it (e.g. `apt-get install -y pandoc`) and re-run.

So on a host bootstrapped from a bare image, those skills fail on their last step. This adds pandoc to install_base_deps so the plugins the bootstrap installs work out of the box.

The dependency list is enumerated in several places; this keeps them in sync:

• install_base_deps (the command -v pandoc || needed+=(pandoc) line, with a comment explaining why) and its block comment.
• The README "Requirements" line listing what a bare ubuntu:22.04 gets.
• The run_e2e comment in test.bash.

Test plan

• ./test.bash (lint + unit)

  === lint ===
  === unit (bats) ===
  1..109
  ...
  ok 53 install_base_deps is a no-op when all required commands are present
  ok 54 install_base_deps installs ripgrep when rg is missing
  ok 55 install_base_deps installs pandoc when pandoc is missing
  ok 56 install_base_deps warns and skips when apt-get is unavailable
  ...
  ok 109 main() runs load_config_file only when given a positional arg (unset env vars populated)
  

  Exit 0, 109/109 pass. One new test (install_base_deps installs pandoc when pandoc is missing, mirroring the ripgrep case); the two existing install_base_deps fixture tests gained pandoc in their present-command sets. The trailing BW01 advisory is the pre-existing load_config_file aborts on malformed input warning, unrelated to this change.

• ./test.bash --docker (full e2e in a fresh ubuntu:22.04 container)

  Run from the main checkout (not a worktree). Exit 0. The new dep is installed on the bare image and all assertions pass in both idempotency runs:

  [bootstrap] Installing base deps: curl python3 git gawk ripgrep pandoc sudo ca-certificates.
  ...
  Setting up pandoc (2.9.2.1-3ubuntu2) ...
  ...
  All e2e assertions passed.
  All e2e assertions passed.
  === e2e passed ===
  === docker e2e passed ===
  

• ./test.bash --secrets (gitleaks v8.18.4)

  66 commits scanned.
  no leaks found
  

• ./test.bash --e2e on a disposable VM — N/A. This change only adds one package to the apt-get base-dep set; it touches nothing visible from a real user shell (no PATH wiring, alias, provider function, SSH key, or git config). The --docker run already exercises the install path end-to-end on a bare image.