feat: Debian prep hardening, verify script, and quality pass

- 00-system-prep.sh: bootstrap sudo when run as root; on Debian enable
  contrib/non-free-firmware (SKIP_NONFREE to opt out) + install needrestart
- scripts/verify-debian.sh: non-destructive post-install sanity checker
  (exit 0/1) covering OS, tools, Debian renames, upstream tooling,
  .NET/Podman/Postgres, groups, flatpak, dotfile symlinks
- 01-package-install.sh: auto-detect current Kubernetes minor from upstream
  (fallback v1.36, override K8S_MINOR) instead of stale v1.32 pin
- fix shellcheck findings (SC2155, SC2207, SC2088); all scripts clean at
  warning severity
- docs: fold decisions/status into plan; README lists new tools

README.md

@@ -51,11 +51,12 @@ Distro-agnostic .NET development environment:
 
 The setup is broken down into focused scripts:
 
-- `00-system-prep.sh` - System updates and Flathub setup
+- `00-system-prep.sh` - System updates, `sudo` bootstrap, Debian `contrib`/`non-free-firmware` + `needrestart`, Flathub setup
 - `01-package-install.sh` - Core packages, upstream tooling, and Flatpak apps
 - `02-dev-tools-setup.sh` - Development tools (Neovim, Go, Rust, Oh-My-Posh, Helm, kubectx, stern, dive, trivy, AWS CLI)
 - `03-dotnet-setup.sh` - .NET SDK + PostgreSQL + Podman (distro-agnostic)
 - `04-config-symlinks.sh` - Dotfile symlinking
+- `verify-debian.sh` - Post-install sanity checker (run manually, no root needed)
 
 You can run individual scripts if you only need specific components.