Adds safe Linux package install support to the installer while keeping tests isolated from package and external installer side effects.

What changed

• add Linux package install paths for Homebrew, apt, dnf, and pacman
• require interactive confirmation by default, or allow opt-in with CORTEX_DOTS_INSTALL_PACKAGES=true
• skip automatic package installs in non-interactive runs
• skip package and external installers in tests
• isolate Ghostty process detection in tests with CORTEX_DOTS_GHOSTTY_PROCESS_NAME

QA

• local oss-audit
• invalid regex fail-closed
• bash/zsh syntax
• shellcheck severity=error
• installer tests: copy/symlink/stale-opposite, dry-run, install --check
• innit02 dry-run and copy/symlink tests passed
• security review clear with no findings

Review focus

• review install.sh package install gating and Linux package manager handling
• review scripts/test-install.sh test isolation flags and Ghostty process override
• out of scope: unrelated installer cleanup or broader package mapping changes