notes/machines.md: new-box setup should cover rclone + R2 credentials nf-n917 ← Beads

Twinned from https://github.com/cfsh/ninefold/issues/1033 by tools/beads/import_github.py's reconcile pass.

Surfaced while cutting the first-ever Linux release (issue #1029): this box had godot export templates but no rclone binary at all, and none of R2_ACCOUNT_ID/R2_ACCESS_KEY_ID/R2_SECRET_ACCESS_KEY set anywhere (shell env, .bashrc/.profile/.zshrc, /etc/environment). tools/release/release.py's CREDS_HELP documents the env vars themselves (and now needs a Linux-native export form alongside the Windows setx one — CREDS_HELP is Windows-only right now) but nothing in notes/machines.md's new-box setup steps installs rclone or walks through getting these three values from the Cloudflare R2 dashboard.

Worth adding to new-box setup: - Install rclone (e.g. curl https://rclone.org/install.sh | sudo bash on Linux). - Where to get R2 credentials: Cloudflare dash -> R2 Object Storage -> Manage R2 API Tokens -> Create API Token (Object Read & Write, scoped to the ninefold bucket) -> copy Access Key ID / Secret Access Key (shown once) and the account id (the 32-hex subdomain of the S3 endpoint URL). - Note credentials should go in a durable location (not just the current shell), and that R2 setup is required even for a --dry-run release (rclone sync --dry-run still authenticates against the real bucket).

Unclaimed.