feat: guided setup — persona re-audit fixes (grade-1 round)

- Regulated path finishes without a terminal: the signed-source
  state offers 'Add a signed source…' (stores dialog with pin-a-key)
  plus the per-module install buttons and a plain-language hint why
  pinning the publisher's key matters — instead of a hint with no
  affordance.
- Apply warnings (e.g. the empty-trusted-publishers caveat) surface
  selectable in the done state instead of being swallowed.
- Truthful preview: new lines state which machine is being set up
  (server/container targets configure THIS machine), that regulated
  profiles always get the hash-chained audit log (even with WORM
  off), and that the curated reading list is stored with the setup
  record.
- Language pass: onboarding checklist in Sie-form + 'System-KI'
  (was du-form + 'System-AI'), 'Audit-Sperre' jargon replaced,
  answers file moved to a private per-dialog temp dir.
- Screenshot harness: GUIDE_SHOTS_THEME=light for light-parity
  proof runs.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

lib/l10n/app_en.arb

@@ -1743,7 +1743,7 @@
   "setupReviewTitle": "This is what Ch∆In will set up",
   "setupChooseFreeText": "Or just describe what you want to do",
   "setupScenTryingOut": "Just trying it out",
-  "setupScenTryingOutSub": "A relaxed workspace on this machine — no signing, no audit locking.",
+  "setupScenTryingOutSub": "A straightforward workstation on this machine — no signature requirement, no write-protected audit log.",
   "setupScenTeamHub": "A shared team hub",
   "setupScenTeamHubSub": "A secured hub for several people — signed modules, resource limits.",
   "setupScenRegulated": "Regulated production",
@@ -1800,6 +1800,16 @@
   "setupAllowUnsigned": "Allow installing from the public store",
   "setupAllowUnsignedSub": "Deliberately relaxes the signature requirement. Fine for trying things out — re-enable it for regulated operation.",
   "setupStartCta": "Get started in 3 questions",
+  "setupPlanRunbookLocal": "This machine is being set up; the hub runs locally and starts on demand.",
+  "setupPlanRunbookService": "This machine is being set up: the hub will start automatically on boot (background service). For a different server, run the setup there.",
+  "setupPlanRunbookAirgap": "Intended for an isolated server without internet — modules and updates arrive as offline bundles.",
+  "setupPlanRunbookContainer": "Intended for container operation — a ready-made compose example is included.",
+  "setupPlanAuditChain": "Every step lands in a gapless, hash-chained audit log — tampering becomes detectable.",
+  "setupPlanDocs": "A matching reading list ({n} chapters) is stored with the setup record under ~/.chain/.",
+  "@setupPlanDocs": {"placeholders": {"n": {"type": "int"}}},
+  "setupTrustedPublishersHint": "Important: when adding the source, pin the publisher's key (\"pin signing key\") — otherwise the hub accepts any formally valid signature, no matter whose.",
+  "setupAddSignedSource": "Add a signed source…",
+  "setupApplyNotes": "Notes from the setup",
   "setupFreeTextHint": "e.g.: pre-screen incoming applications and flag incomplete ones",
   "setupFreeTextSuggest": "Suggest a setup",
   "setupFreeTextPrivacyLocal": "Your description is processed locally on this machine ({model}).",