fix: resolve all 23 MAINTENANCE audit tickets

- deps guards before -h|--help in docker-health/ps, network-scan,
  usb-server, media-mp3/mp4 (--dry-run pre-scan kept); system-firewall
  gains usage()/--help; autostart/usb-automount get flags.sh + template
- install.sh: normalize N-M range syntax in --steps
- bin/pos: INTERACTIVE_CMDS += docker-compose docker-vbox network-hotspot
- common.sh: canonical XDG-aware CONFIG_DIR + DIM color var; notify.sh
  stderr fallback; ent_plugin_* registry renames (runtime plugin API kept)
- docker-compose SCALE_DIR/CONFIG_ENV env seams; ffmpeg in PACKAGES;
  scrcpy.sh exec bit
- docs: health is console-only (--send/--markdown removed), POS.md file
  refs for config/tree/entertainment, DEV.md no-guard exception, docmap/
  filetable regenerated (make gen), hand-maintained line rows bumped
- add scripts/lint-conventions.sh gate + Makefile lint target; record
  all VERIFIED outcomes in MAINTENANCE.md; AGENT_TODO Done entry
  (2026-08-14)
- gates: make gen/check/lint all green (0 FAIL, 0 WARN); bash -n sweep
  clean; restricted-PATH dep tests + step-matrix dry-runs verified

features/autostart.sh

@@ -1,4 +1,40 @@
 #!/usr/bin/env bash
+set -euo pipefail
+
+# ────────────────────────────────────────────────────────────────
+# autostart feature — tiny boot-time log marker.
+#
+# Installed on demand with:  ./install.sh --feature
+#   → copied to /usr/local/bin/autostart.sh (chmod 755)
+#   → flag "autostart" is set
+# ────────────────────────────────────────────────────────────────
+
+# Robust flags.sh load — works from the repo checkout AND from
+# /usr/local/bin after install.sh (which copies lib/flags.sh there).
+source "$(dirname "$0")/../lib/flags.sh" 2>/dev/null || source "$(dirname "$0")/flags.sh"
+
+# Self-name → matches the flag install.sh sets for this feature.
+FEATURE_NAME="$(basename "$0")"
+FEATURE_NAME="${FEATURE_NAME%.sh}"
+
+usage() {
+    cat <<EOF
+Usage: autostart.sh [options]
+
+Boot-time connectivity marker — appends a timestamped Network:
+online/offline line to ~/.autostart.log (idempotent, safe to run
+repeatedly).
+
+Installed via:  ./install.sh --feature
+Flag:           ${FEATURE_NAME}
+Log:            ${HOME:-/root}/.autostart.log
+EOF
+    exit 0
+}
+
+case "${1:-}" in
+    -h|--help) usage ;;
+esac
 
 LOG="${HOME:-/root}/.autostart.log"
 

features/usb-automount.sh

@@ -1,6 +1,10 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+# Robust flags.sh load — works from the repo checkout AND from
+# /usr/local/bin after install.sh (which copies lib/flags.sh there).
+source "$(dirname "$0")/../lib/flags.sh" 2>/dev/null || source "$(dirname "$0")/flags.sh"
+
 # ────────────────────────────────────────────────────────────────
 # USB automount feature — auto-mounts removable USB storage.
 #