feat: Debian prep hardening, verify script, and quality pass

- 00-system-prep.sh: bootstrap sudo when run as root; on Debian enable
  contrib/non-free-firmware (SKIP_NONFREE to opt out) + install needrestart
- scripts/verify-debian.sh: non-destructive post-install sanity checker
  (exit 0/1) covering OS, tools, Debian renames, upstream tooling,
  .NET/Podman/Postgres, groups, flatpak, dotfile symlinks
- 01-package-install.sh: auto-detect current Kubernetes minor from upstream
  (fallback v1.36, override K8S_MINOR) instead of stale v1.32 pin
- fix shellcheck findings (SC2155, SC2207, SC2088); all scripts clean at
  warning severity
- docs: fold decisions/status into plan; README lists new tools

scripts/01-package-install.sh

@@ -76,7 +76,7 @@ fi
 
 # Combine package lists
 PACKAGE_LIST=("${BASE_PACKAGE_LIST[@]}" "${DISTRO_SPECIFIC_PACKAGES[@]}")
-PACKAGE_LIST=($(printf "%s\n" "${PACKAGE_LIST[@]}" | LC_ALL=C sort -u))
+mapfile -t PACKAGE_LIST < <(printf "%s\n" "${PACKAGE_LIST[@]}" | LC_ALL=C sort -u)
 
 # --- apt helpers ---------------------------------------------------------
 _apt_is_installed() {
@@ -210,10 +210,21 @@ _apt_add_hashicorp_repo() {
         | sudo tee /etc/apt/sources.list.d/hashicorp.list >/dev/null
 }
 
-# Kubernetes apt repo. Bump K8S_MINOR to track the current stable minor.
-K8S_MINOR="v1.32"
+# Kubernetes apt repo. Auto-detects the latest stable minor from the
+# kubernetes/kubernetes GitHub release feed, falling back to a pinned minor
+# if the API is unreachable. Override explicitly with K8S_MINOR=...
+K8S_MINOR_FALLBACK="v1.36"
+_k8s_latest_minor() {
+    local tag minor
+    tag="$(curl -fsSL --max-time 10 https://api.github.com/repos/kubernetes/kubernetes/releases/latest \
+        | grep '"tag_name"' | cut -d'"' -f4)" || return 1
+    minor="${tag#v}"        # e.g. 1.36.0
+    minor="${minor%.*}"     # strip patch -> 1.36
+    echo "v${minor}"
+}
 _apt_add_kubernetes_repo() {
     [ -f /etc/apt/sources.list.d/kubernetes.list ] && { echo "Kubernetes repo already configured."; return 0; }
+    K8S_MINOR="${K8S_MINOR:-$(_k8s_latest_minor || echo "$K8S_MINOR_FALLBACK")}"
     echo "Adding Kubernetes apt repository (${K8S_MINOR})..."
     curl -fsSL "https://pkgs.k8s.io/core:/stable:/${K8S_MINOR}/deb/Release.key" \
         | sudo gpg --dearmor -o /usr/share/keyrings/kubernetes-archive-keyring.gpg