fix: update bun to tap-qualified name oven-sh/bun/bun

bun was removed from homebrew-core and is now only available via
the oven-sh/bun tap. Update the catalog entry so brew can resolve it.

test(permissions): remove OpenScreenRecordingSettings test that pops …

…System Settings UI

The test called open x-apple.systempreferences:... on every unit test run,
opening System Settings on the developer's machine. The assertion was also
trivially meaningless (asserting err is of type *error, always true).
Removed; behavior is covered by VM-level tests in a controlled environment.

feat: expand Finder preferences snapshot from 5 to 23 items

Add view settings (sidebar, tab bar, preview pane, POSIX path in title),
behavior settings (search scope, sort folders first, trash warnings, quit
menu item), new window target, desktop icon visibility, and .DS_Store
suppression on network/USB volumes.

fix: improve setup-agent output with rule path and explanation

feat: allow updating existing config when uploading snapshot

When uploading via `openboot snapshot`, detect sync source and offer
"Update existing config" vs "Create new". Uses PUT with config_slug
for updates. Also consolidates promptConfigDetails into promptPushDetails,
adds 409 conflict handling, and fixes missing TrimSpace in push prompts.

fix: preserve package descriptions through snapshot export/import

Add MarshalJSON to PackageSnapshot that outputs rich object format
when descriptions exist, preserving them through export → re-import.
Also show descriptions in runCustomInstall display and fix
UnmarshalJSON to accept rich objects with casks/npm only.

Fixes #14

fix: use regex match for CIRRUS_TAG to prevent L3 on branch pushes

$CIRRUS_TAG != '' evaluates true even when undefined. Switch to
=~ 'v.*' so L3 tasks only trigger on version tags.

feat: add VM-based E2E testing with Tart

Add comprehensive end-to-end test suite using disposable Tart macOS VMs.
Tests cover the full user journey from bare macOS to configured dev
environment, validating real system state rather than just command output.

Infrastructure:
- testutil/tartvm.go: VM lifecycle management (clone, boot, SSH, expect, destroy)
- Three-tier Makefile targets: test-vm-quick (5min), test-vm-release (20min), test-vm-full (60min)
- Cirrus CI config for cloud-based parallel VM testing

Test coverage (48 test functions):
- 9 user journey tests (first-time install, dry-run safety, snapshot accuracy,
  diff consistency, idempotency, packages-only, manual uninstall recovery,
  full setup, error messages)
- 10 edge case tests (snapshot import/restore, clean removal, cask verification,
  npm packages, shell functionality, remote config, developer preset,
  post-install scripts, version upgrade compatibility, partial failure recovery)
- 13 command tests (every command and flag)
- 6 interactive tests (expect-based TUI simulation)
- 4 install flow tests + 4 lifecycle tests + 1 infra test

Discovered and fixed 3 bugs via these tests (see previous commit).

feat: preserve package descriptions through import/export lifecycle

Introduce PackageEntry{Name, Desc} and PackageEntryList type to replace
[]string for Packages, Casks, and Npm fields in RemoteConfig. Descriptions
from imported JSON configs are now preserved through parsing, TUI display,
push, and export. Taps remain []string (no descriptions).

PackageEntryList.UnmarshalJSON handles both flat string arrays and
{name, desc} object arrays. Objects with a "type" field are rejected
so UnmarshalRemoteConfigFlexible can split them by type correctly.

Closes #14

fix: allow any HTTPS host for dotfiles repo

Remove the 4-host allowlist (github, gitlab, bitbucket, codeberg).
Self-hosted GitLab and other git hosts are valid as long as they
use HTTPS. Path traversal and format checks are kept.