feat(init): surface the hack global install requirement in init output

Both init paths now tell first-time users/agents that full *.hack
routing needs hack global install (sudo, machine-wide DNS/CA) — field
agents hit this as a late surprise.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: roodboi

src/commands/project.ts

@@ -3420,6 +3420,8 @@ async function handleInit({
       "Next:",
       "  hack up",
       "  hack open",
+      "",
+      "First time on this machine? Run `hack global install` for *.hack DNS/TLS (needs sudo).",
     ].join("\n"),
     "Initialized"
   );
@@ -3567,6 +3569,10 @@ async function handleInitAuto({
   logger.info({
     message: "Next: hack up --detach && hack open",
   });
+  logger.info({
+    message:
+      "First time on this machine? Run `hack global install` for *.hack DNS/TLS (needs sudo).",
+  });
 
   if (withValue) {
     await runInitOnboardingHandoff({