feat: guided setup — persona re-audit fixes (grade-1 round)

- Regulated path finishes without a terminal: the signed-source
  state offers 'Add a signed source…' (stores dialog with pin-a-key)
  plus the per-module install buttons and a plain-language hint why
  pinning the publisher's key matters — instead of a hint with no
  affordance.
- Apply warnings (e.g. the empty-trusted-publishers caveat) surface
  selectable in the done state instead of being swallowed.
- Truthful preview: new lines state which machine is being set up
  (server/container targets configure THIS machine), that regulated
  profiles always get the hash-chained audit log (even with WORM
  off), and that the curated reading list is stored with the setup
  record.
- Language pass: onboarding checklist in Sie-form + 'System-KI'
  (was du-form + 'System-AI'), 'Audit-Sperre' jargon replaced,
  answers file moved to a private per-dialog temp dir.
- Screenshot harness: GUIDE_SHOTS_THEME=light for light-parity
  proof runs.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

CHANGELOG.md

@@ -42,6 +42,27 @@ version + `kStudioVersion` in `lib/main.dart` stay in lockstep.
   silently skipped since the rename; it now resolves `$CHAIN_BIN`,
   `chain` on PATH, and `../fai_chain/target/{release,debug}/chain`.
 
+### Added (guided setup — persona re-audit fixes, grade-1 round)
+
+- **Regulated path finishes without a terminal.** The post-apply
+  signed-source state now offers "Add a signed source…" (the stores
+  dialog with its pin-a-key field) plus the per-module install
+  buttons, instead of a hint with no affordance; a plain-language
+  trust hint explains why pinning the publisher's key matters.
+- **Apply warnings surface.** Warning lines from `chain init --apply`
+  (e.g. the empty-trusted-publishers caveat) are shown selectable in
+  the done state instead of being swallowed on success.
+- **Truthful preview.** New plan lines state which machine is being
+  set up (server/container targets configure THIS machine — said
+  explicitly), that regulated profiles get the hash-chained audit
+  log even when WORM is off, and that a curated reading list is
+  stored with the setup record.
+- **Language pass.** Onboarding checklist switched to Sie-form and
+  "System-KI" (was du-form + "System-AI" next to the formal wizard);
+  "Audit-Sperre" jargon replaced with "Schreibschutz für das
+  Prüfprotokoll"; answers file now lives in a private per-dialog
+  temp dir instead of a fixed world-readable name.
+
 ### Added (multi-project, stage ③ — sealed areas)
 
 - **Sealed-area connection switch.** The workspace switcher now lists