On first deploy to a new server, deploy.sh: 1. Installs age and sops binaries if missing 2. Generates an age keypair if missing 3. Prints the public key and exits with instructions All checks are idempotent — subsequent deploys skip to decryption. Removed duplicate sops/age setup from setup_server.sh (deploy.sh handles it). Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>