…ed (#238)

publish-pypi.yml was failing with HTTP 400 'File already exists' when a
v* tag got force-pushed (e.g. when fixing release.yml's Docker job for
v0.5.2 — see #235). The publish step has nothing to do, but the action
defaults to skip-existing=false, so the no-op surfaces as a failure.

Set skip-existing=true: PyPI immutability means re-publish is a logical
no-op anyway, and treating it as a hard error means every tag-fix dance
leaves a red X behind that's actually a non-event.

Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]>

* fix(ci): pypi-publish skip-existing=true so re-pushed tags don't go red

publish-pypi.yml was failing with HTTP 400 'File already exists' when a
v* tag got force-pushed (e.g. when fixing release.yml's Docker job for
v0.5.2 — see #235). The publish step has nothing to do, but the action
defaults to skip-existing=false, so the no-op surfaces as a failure.

Set skip-existing=true: PyPI immutability means re-publish is a logical
no-op anyway, and treating it as a hard error means every tag-fix dance
leaves a red X behind that's actually a non-event.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

* feat(cli): forkd quickstart — zero-to-first-fork in one command

Conversion-funnel work: stars are growing ~10x faster than downloads,
and the most-cited reason is first-run friction (host setup, kernel
download, snapshot bake, netns provisioning — four manual steps across
two scripts and three verbs before the first fork).

`sudo -E forkd quickstart` collapses that to one command:

1. doctor::preflight() — hard-gates on platform/KVM/firecracker;
   reports kernel/tap/docker as data rather than failures
2. Heals what's missing WITH CONSENT (or --yes): guest kernel
   download, tap creation, netns provisioning. The setup scripts are
   embedded via include_str! so a tarball install works without the
   repo checked out; an interactive prompt lists exactly what will be
   touched before anything runs. Nothing on the host changes without
   an explicit yes.
3. Snapshot: reuse existing > bake from python:3.12-slim via local
   Docker (preferred — uses *this host's* Firecracker, so the vmstate
   can never hit cross-FC-version restore errors) > hub pull fallback
   with a compat warning.
4. fork -n 10 --per-child-netns, then prints next steps.

Idempotent: re-running skips completed setup and reuses the snapshot.

README: new "One command" section at the top of Quick start; stale
v0.3.4 tarball URLs bumped to v0.5.2.

Co-Authored-By: Claude Fable 5 <[email protected]>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <[email protected]>