feat: guided setup — persona re-audit fixes (grade-1 round)

- Regulated path finishes without a terminal: the signed-source
  state offers 'Add a signed source…' (stores dialog with pin-a-key)
  plus the per-module install buttons and a plain-language hint why
  pinning the publisher's key matters — instead of a hint with no
  affordance.
- Apply warnings (e.g. the empty-trusted-publishers caveat) surface
  selectable in the done state instead of being swallowed.
- Truthful preview: new lines state which machine is being set up
  (server/container targets configure THIS machine), that regulated
  profiles always get the hash-chained audit log (even with WORM
  off), and that the curated reading list is stored with the setup
  record.
- Language pass: onboarding checklist in Sie-form + 'System-KI'
  (was du-form + 'System-AI'), 'Audit-Sperre' jargon replaced,
  answers file moved to a private per-dialog temp dir.
- Screenshot harness: GUIDE_SHOTS_THEME=light for light-parity
  proof runs.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

lib/l10n/app_localizations_en.dart

@@ -2993,7 +2993,7 @@ class AppLocalizationsEn extends AppLocalizations {
 
   @override
   String get setupScenTryingOutSub =>
-      'A relaxed workspace on this machine — no signing, no audit locking.';
+      'A straightforward workstation on this machine — no signature requirement, no write-protected audit log.';
 
   @override
   String get setupScenTeamHub => 'A shared team hub';
@@ -3179,6 +3179,41 @@ class AppLocalizationsEn extends AppLocalizations {
   @override
   String get setupStartCta => 'Get started in 3 questions';
 
+  @override
+  String get setupPlanRunbookLocal =>
+      'This machine is being set up; the hub runs locally and starts on demand.';
+
+  @override
+  String get setupPlanRunbookService =>
+      'This machine is being set up: the hub will start automatically on boot (background service). For a different server, run the setup there.';
+
+  @override
+  String get setupPlanRunbookAirgap =>
+      'Intended for an isolated server without internet — modules and updates arrive as offline bundles.';
+
+  @override
+  String get setupPlanRunbookContainer =>
+      'Intended for container operation — a ready-made compose example is included.';
+
+  @override
+  String get setupPlanAuditChain =>
+      'Every step lands in a gapless, hash-chained audit log — tampering becomes detectable.';
+
+  @override
+  String setupPlanDocs(int n) {
+    return 'A matching reading list ($n chapters) is stored with the setup record under ~/.chain/.';
+  }
+
+  @override
+  String get setupTrustedPublishersHint =>
+      'Important: when adding the source, pin the publisher\'s key (\"pin signing key\") — otherwise the hub accepts any formally valid signature, no matter whose.';
+
+  @override
+  String get setupAddSignedSource => 'Add a signed source…';
+
+  @override
+  String get setupApplyNotes => 'Notes from the setup';
+
   @override
   String get setupFreeTextHint =>
       'e.g.: pre-screen incoming applications and flag incomplete ones';