feat: Debian prep hardening, verify script, and quality pass

- 00-system-prep.sh: bootstrap sudo when run as root; on Debian enable
  contrib/non-free-firmware (SKIP_NONFREE to opt out) + install needrestart
- scripts/verify-debian.sh: non-destructive post-install sanity checker
  (exit 0/1) covering OS, tools, Debian renames, upstream tooling,
  .NET/Podman/Postgres, groups, flatpak, dotfile symlinks
- 01-package-install.sh: auto-detect current Kubernetes minor from upstream
  (fallback v1.36, override K8S_MINOR) instead of stale v1.32 pin
- fix shellcheck findings (SC2155, SC2207, SC2088); all scripts clean at
  warning severity
- docs: fold decisions/status into plan; README lists new tools

main-setup.sh

@@ -54,7 +54,8 @@ prompt_yes_no() {
 # Function to run a script if approved
 run_script() {
     local script_path="$1"
-    local script_name="$(basename "$script_path")"
+    local script_name
+    script_name="$(basename "$script_path")"
     
     if ! bash "$script_path"; then
         echo "ERROR: $script_name failed."