[codex] Keep dotfiles bootstrap generic

[willgriffin]

Summary

• Remove HappyVertical-specific resolver/materialization from dotfiles
• Keep dotfiles focused on workstation tooling, shells, AI CLIs, and personal stowed config
• Add a generic dry-run/audit path
• Make Linux privileged package commands noninteractive-safe by skipping when root/sudo is unavailable
• Keep generic SOPS/age/GPG tooling install support

Impact

dotfiles/install.sh can be used directly for personal/tooling setup without pulling HappyVertical or Hermes policy into the personal dotfiles repo. HappyVertical/Hermes orchestration now belongs in have-config.

Validation

• bash -n install.sh
• ./install.sh --dry-run
• git diff --check