fix(setup): wizard errors copyable above the dialog, CLI skew explained, exec transparency

Field test of the setup wizard surfaced three trust breaks in one run:
an unexplained macOS Documents permission prompt, a perceived crash,
and an error message whose copy button could not be reached.

Root causes and fixes:
- chain init failures were shown as a SnackBar, which lands BEHIND the
  wizard's modal barrier: dimmed, clipped, copy unreachable — and the
  click aimed at it hit the barrier, dismissing the whole wizard with
  all answers (the perceived crash). Errors now open a modal dialog
  ABOVE the wizard via showChainErrorDialog with a copyable detail
  block, and the wizard is no longer barrier-dismissible.
- When the resolved chain binary is older than Studio and rejects
  --plan-json, the wizard now explains the version skew in plain
  language (binary path + update path) instead of leaking a raw clap
  usage error. A missing binary gets its own localized story.
- Step 3 announces which chain binary the preview will execute; when
  that binary physically lives (symlinks resolved) in a TCC-protected
  folder, the wizard pre-explains the macOS folder prompt.

Supporting changes: FriendlyError passes through friendlyError()
unchanged so call sites can ship precise localized stories through the
shared presentation; SystemActions gains resolvedChainBinary() plus
run/resolve test seams; ChainErrorBox hugs its content instead of
filling an unbounded dialog; the wizard's answers file is written
synchronously (the async dart:io variants never complete under the
widget-test fake-async zone).

Verified: flutter analyze clean, 53 tests green (6 new wizard error-
path tests incl. clipboard round-trip), plus a live GUI walk on macOS
in dark + light with a stale binary (skew dialog, copy verified via
clipboard) and with the real binary (TCC pre-explanation with the
resolved path, full plan preview).

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

CHANGELOG.md

@@ -5,6 +5,36 @@ version + `kStudioVersion` in `lib/main.dart` stay in lockstep.
 
 ## Unreleased
 
+### Fixed (wizard live-run findings 2026-07-14)
+
+Field test of the setup wizard surfaced three trust breaks in one
+run; all were reproduced against a stale CLI and fixed:
+
+- **Errors surfaced behind the wizard.** `chain init` failures were
+  shown as a SnackBar, which lands BEHIND the wizard's modal barrier:
+  dimmed, clipped, its copy button unreachable — and the operator's
+  click at it hit the barrier, which (dismissible by default) closed
+  the whole wizard with all answers. Now: failures open a modal error
+  dialog ABOVE the wizard (copy button works, verbatim CLI output
+  behind "Details"), and the wizard is no longer barrier-dismissible —
+  leaving it is explicit via Abbrechen/Zurück.
+- **CLI version skew explained.** When the resolved `chain` binary is
+  older than Studio and rejects `--plan-json`, the wizard now names
+  the skew in plain language — which binary was executed, that it
+  predates the assistant, and the update path — instead of leaking a
+  raw clap usage error. A missing binary gets the same treatment plus
+  a hint on step 3 before anything runs.
+- **macOS folder prompt pre-explained.** Step 3 now states which
+  `chain` binary the preview will execute; when that binary physically
+  lives (symlinks resolved) in a TCC-protected folder (Documents/
+  Desktop/Downloads), the wizard says up front that macOS may ask for
+  folder access — instead of a bare permission prompt appearing in
+  the middle of setup.
+- `FriendlyError` values now pass through `friendlyError()` unchanged
+  so call sites can route precise, localized stories through the
+  shared error presentation; `SystemActions` gained a public
+  `resolvedChainBinary()` and test seams for the run/resolve paths.
+
 ### Added (guided setup on grade-1 — steps A4/A5/B1 + doc automation)
 
 - **Clickable next steps.** After apply, the wizard renders real