feat: guided setup — persona re-audit fixes (grade-1 round)

- Regulated path finishes without a terminal: the signed-source
  state offers 'Add a signed source…' (stores dialog with pin-a-key)
  plus the per-module install buttons and a plain-language hint why
  pinning the publisher's key matters — instead of a hint with no
  affordance.
- Apply warnings (e.g. the empty-trusted-publishers caveat) surface
  selectable in the done state instead of being swallowed.
- Truthful preview: new lines state which machine is being set up
  (server/container targets configure THIS machine), that regulated
  profiles always get the hash-chained audit log (even with WORM
  off), and that the curated reading list is stored with the setup
  record.
- Language pass: onboarding checklist in Sie-form + 'System-KI'
  (was du-form + 'System-AI'), 'Audit-Sperre' jargon replaced,
  answers file moved to a private per-dialog temp dir.
- Screenshot harness: GUIDE_SHOTS_THEME=light for light-parity
  proof runs.

Signed-off-by: flemming-it <stefan.a.flemming@googlemail.com>

test/guided_setup_test.dart

@@ -163,17 +163,46 @@ void main() {
   );
 
   testWidgets(
-    'applied regulated (signed) state guides to the signed source instead of dead-end install buttons',
+    'applied regulated (signed) state stays clickable — signed-source dialog, trust hint, install buttons',
     (tester) async {
       await tester.pumpWidget(_seededHost(_regulatedPlan(), applied: true));
       await tester.tap(find.text('open'));
       await tester.pumpAndSettle();
 
+      // The plain-language story + the pin-the-publisher trust hint.
+      expect(find.textContaining('signierten Quelle'), findsOneWidget);
       expect(
-        find.textContaining('signierten Quelle'),
+        find.textContaining('Schlüssel des Herausgebers'),
+        findsOneWidget,
+      );
+      // No dead end: the stores dialog (with its pin-a-key field) is
+      // one click away, and the installs stay available for after
+      // the source is added.
+      expect(find.text('Signierte Quelle hinzufügen…'), findsOneWidget);
+      expect(find.text('text.extract installieren'), findsOneWidget);
+      expect(find.textContaining('chain store add'), findsNothing);
+    },
+  );
+
+  testWidgets(
+    'review preview names the machine being set up and the audit chain',
+    (tester) async {
+      await tester.pumpWidget(_seededHost(_regulatedPlan()));
+      await tester.tap(find.text('open'));
+      await tester.pumpAndSettle();
+
+      // Runbook honesty: a "home server" target still configures
+      // THIS machine — the preview must say so.
+      expect(
+        find.textContaining('Eingerichtet wird dieser Rechner'),
+        findsOneWidget,
+      );
+      // The regulated promise is stated even when WORM is off:
+      // the hash-chained audit log line is always there.
+      expect(
+        find.textContaining('hash-verketteten Prüfprotokoll'),
         findsOneWidget,
       );
-      expect(find.text('text.extract installieren'), findsNothing);
     },
   );