fix: honor --dry-run across install phases; repair repo conventions and doc drift

- spawn() now respects DRY_RUN, install.sh exports it to child phases, and
  postinstall.sh wraps every user-home mutation in run() — '--dry-run' no
  longer runs apt/install/clone or edits dotfiles for real
- gen-docs.sh chmods regenerated files to 644 (mktemp mv left them at 0600)
- make check now syntax-checks apps/, entertainment/, features/, templates/
- .gitignore protects config/authorized_keys + config/rclone.conf; drop the
  tracked empty authorized_keys and the stray 6 MB session file
- pos-system-health --send prints 'sent:' only when a platform sender exists,
  otherwise warns on stderr (notify_send is silent-fail)
- standardize sourced libs (no shebang); refresh AGENT_Context/DEV/APPS/SCRIPTS
  doc drift: notify.sh in lib lists, pos-health systemd units, tsui, scripts/,
  INTERACTIVE_CMDS list, entertainment scheduler (systemd timers only)

scripts/check-sync.sh

@@ -12,7 +12,8 @@ note() { echo "  ✗ $*"; }
 
 # ── 1. Syntax ───────────────────────────────────────────────────
 for f in bin/pos bin/pos-* lib/*.sh install.sh preinstall.sh postinstall.sh \
-         completions/pos.bash scripts/*.sh; do
+         completions/pos.bash scripts/*.sh apps/*/*.sh entertainment/*.sh \
+         features/*.sh templates/*.sh; do
     [ -f "$f" ] || continue
     bash -n "$f" 2>/dev/null || { note "syntax error in $f"; fail=1; }
 done