feat(flags): WI-2 --only selective install + order preservation (#468)

[primetimetank21]

WI-2: --only Selective Install + Order Preservation (#468)

Part of the flags-first customizable install plan — see #468.

---

What's in scope

• --only=<csv> / -Only "<csv>" — installs ONLY the listed tools and exits.
• Order-preservation invariant: the selected set installs in DEFAULT_TOOLS /
  $DefaultTools order, NOT input order. --only=copilot-cli,nvm still installs
  nvm before copilot-cli (npm must be on PATH first).
• Opt-in tools (present in tools/ or registry but NOT in DEFAULT_TOOLS) are
  reachable via --only. They append after the default-ordered tools, alphabetically.
  This gives Install delta (git-delta) as an opt-in tool #466 (git-delta) and Install lazygit as an opt-in tool #467 (lazygit) a home.
• --only=copilot-cli works on both platforms: the copilot-cli -> Install-CopilotCli
  alias was already in the Windows $ToolRegistry (WI-1, Q3 decision); Linux uses the
  copilot-cli.sh script by filename.
• Root setup.ps1 now forwards -Only / -Skip (params were intentionally omitted in
  WI-1 as YAGNI — now implemented).
• Empty / malformed CSV validation: --only= / --only=,foo / --only=foo,,bar all
  exit 1 with a clear error.
• Unknown tool name: exits 1 and suggests --list.

What is NOT in scope (WI-3)

• --skip flag (code already exists from WI-1 skeleton but is WI-3 scope)
• --only / --skip mutual-exclusion enforcement (WI-3)
• No-selection-state persistence tests (WI-3)

Unblocks

• Install delta (git-delta) as an opt-in tool #466 (git-delta tool script): can now be installed via --only=delta
• Install lazygit as an opt-in tool #467 (lazygit tool script): can now be installed via --only=lazygit

---

Test results — TDD red → green

Bash (tests/test_setup_flags.sh)

WI-2 tests added: 12

• RED before fix (2): T_only_order_preserved, T_only_optin_order
• GREEN before fix (10): single/multi/unknown/empty/blank-csv/copilot-alias/root/compat-gate

After implementation: 12/12 GREEN (10 WI-1 + 12 WI-2 = all pass)

PowerShell (tests/test_setup_flags_pwsh.ps1)

WI-2 tests added: 13

• RED before fix (3): T_only_order_preserved, T_only_optin_order, T_root_only
• GREEN before fix (10): single/multi/optin/unknown/empty/blank-csv/copilot-alias/compat-gate

After implementation: 23/23 GREEN (10 WI-1 + 13 WI-2 = all pass)

Backward-compat gate: T_backward_compat_gate (bash + PS) confirms no-arg run still
produces full DEFAULT_TOOLS list in order — no regression.

Pre-existing failures (unchanged from develop): 8 failures in test_windows_setup.ps1
(copilot-live + O-1..O-7). No new regressions introduced.

---

Implementation notes

• Bash order-preservation: build_final_toolset() iterates DEFAULT_TOOLS and includes
  each tool if it was requested. Opt-in tools (not in DEFAULT_TOOLS) are collected and
  appended sorted alphabetically. Bash 3.2 safe: no mapfile, local -n, declare -n.
• PS order-preservation: foreach ($tool in $DefaultTools) filter + Sort-Object for
  opt-in tools. Uses $PSBoundParameters.ContainsKey('Only') to correctly distinguish
  "not passed" from "passed as empty string".
• Root setup.ps1: $Only / $Skip added to param block; forwarded in
  $_fwdParams at script scope (PSAnalyzer sees them as used).

---

Files touched

File	Change
scripts/linux/setup.sh	ARG_ONLY_SET sentinel + order-preserving build_final_toolset
scripts/windows/setup.ps1	$PSBoundParameters guard + order-preserving $FinalTools build
setup.ps1 (root)	Add $Only/$Skip params + forward to platform script
tests/test_setup_flags.sh	12 WI-2 bash tests
tests/test_setup_flags_pwsh.ps1	13 WI-2 PS tests

---

Closes partial milestone of #468. Base: develop.