fix: honor --dry-run across install phases; repair repo conventions and doc drift

- spawn() now respects DRY_RUN, install.sh exports it to child phases, and
  postinstall.sh wraps every user-home mutation in run() — '--dry-run' no
  longer runs apt/install/clone or edits dotfiles for real
- gen-docs.sh chmods regenerated files to 644 (mktemp mv left them at 0600)
- make check now syntax-checks apps/, entertainment/, features/, templates/
- .gitignore protects config/authorized_keys + config/rclone.conf; drop the
  tracked empty authorized_keys and the stray 6 MB session file
- pos-system-health --send prints 'sent:' only when a platform sender exists,
  otherwise warns on stderr (notify_send is silent-fail)
- standardize sourced libs (no shebang); refresh AGENT_Context/DEV/APPS/SCRIPTS
  doc drift: notify.sh in lib lists, pos-health systemd units, tsui, scripts/,
  INTERACTIVE_CMDS list, entertainment scheduler (systemd timers only)

install.sh

@@ -14,7 +14,9 @@ fi
 source "$(dirname "$0")/lib/common.sh"
 source "$(dirname "$0")/lib/flags.sh"
 
-DRY_RUN=0
+# Exported so child phases (preinstall.sh, postinstall.sh) inherit it —
+# otherwise '--dry-run' silently executes them for real.
+export DRY_RUN=0
 RUN_APPS=0
 RUN_FEATURES=0
 SKIP_PHASES=""