fix: honor --dry-run across install phases; repair repo conventions and doc drift

- spawn() now respects DRY_RUN, install.sh exports it to child phases, and
  postinstall.sh wraps every user-home mutation in run() — '--dry-run' no
  longer runs apt/install/clone or edits dotfiles for real
- gen-docs.sh chmods regenerated files to 644 (mktemp mv left them at 0600)
- make check now syntax-checks apps/, entertainment/, features/, templates/
- .gitignore protects config/authorized_keys + config/rclone.conf; drop the
  tracked empty authorized_keys and the stray 6 MB session file
- pos-system-health --send prints 'sent:' only when a platform sender exists,
  otherwise warns on stderr (notify_send is silent-fail)
- standardize sourced libs (no shebang); refresh AGENT_Context/DEV/APPS/SCRIPTS
  doc drift: notify.sh in lib lists, pos-health systemd units, tsui, scripts/,
  INTERACTIVE_CMDS list, entertainment scheduler (systemd timers only)

scripts/gen-docs.sh

@@ -169,6 +169,8 @@ regen_block() {
             skip { next }
             { print }
         ' "$file" > "$tmp"
+        # mktemp creates 0600 files — mv would leave the doc/completion at 0600
+        chmod 644 "$tmp"
         mv "$tmp" "$file"
     fi
     rm -f "$newfile"