feat: add Zi Setup terminal pilot

[ss-o]

The setup engine is safe and reviewable, but its artifact paths, plan hashes, and phased apply contract are too low level for guided onboarding. This adds the standalone Go client that presents those exact artifacts without duplicating installer decisions.

The client provides Bubble Tea, plain, and headless flows over one workflow. It strictly validates zi-setup-describe-v1, zi-setup-plan-v1, and zi-setup-result-v1; sanitizes all terminal text; shows generated Zsh and bounded file diffs; passes the reviewed plan hash to both apply phases; preserves partial failure results; and verifies a reopened plan has no content changes. Selectable profiles remain limited to loader and annex; zunit is compatibility-only.

The repository envelope includes GPL-3 licensing, Go 1.26 module pins, cross-platform Go CI, CodeQL, the organization commit-policy caller, and the review skill pinned to z-shell/.github@ce74af22db3af827eed9558596275cdf3fb07505.

Validation:

• go test -count=1 ./...
• go test -race -count=1 ./...
• go vet ./...
• go mod tidy -diff and go mod verify
• actionlint .github/workflows/*.yml plus YAML parsing
• CGO-free builds for Linux amd64/arm64, macOS amd64/arm64, and Windows amd64
• sh ./tests/installers.sh in the matching z-shell/src engine checkout
• Disposable loader and annex apply, generated startup, and unchanged reopen
• Drift, symlink, network failure, partial phase, 80x24 PTY, quit, and ctrl-c paths

A verified engine-bundle bootstrap, release packaging, streaming apply events, and additional capability choices remain outside this pilot.

Closes z-shell/src#222

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[ss-o]

Fallback review under ADR-0026: Copilot request not registered on 265fdcb

No actionable findings remain on this exact head. The independent review verified that the four prior findings are resolved: Ctrl+C cannot cancel an in-flight apply, successful files results require a clean absolute receipt path, the zunit compatibility profile cannot be selectable, and all restricted fact values are validated.

Validation passed: go test -count=1 ./..., go test -race -count=1 ./..., go vet ./..., go mod tidy -diff, go mod verify, actionlint, and git diff --check main...HEAD. All 12 hosted PR checks are also green.

Residual evidence gaps: native macOS and Windows runtime behavior was not exercised locally, and this final pass did not repeat the earlier real-engine pseudo-terminal scenarios.