Add pre-push gate, container smoke test, README docs; drop vendored gum.md

- hooks/pre-push: bash -n + shellcheck -S warning -e SC1090 on every
  tracked *.sh; fails closed when shellcheck is missing, bypassable with
  --no-verify; enable with 'git config core.hooksPath hooks' (documented)
- tests/smoke.sh: manual docker/podman Arch-container run of bat.sh,
  zsh.sh and fish.sh with assertions (idempotent bat config, timestamped
  zsh backups, fisher actually installed in fish); LazyVim.sh opt-in.
  This catches the inverted-condition/quoting class shellcheck cannot.
  fish.sh gains a SKIP_END4_SETUP=1 test hook to skip end-4's installer
- README: scripts table (documents installbeta.sh vs install.sh and why
  SecureBoot.sh is not in the menu), apt full-upgrade note, development
  section; claims audited against current behavior (gum wording already
  correct, no whiptail/selection claims remain)
- remove untracked vendored gum.md (reference only, per decision)

fish.sh

@@ -98,13 +98,19 @@ if [ -n "$SCRIPT_DIR" ] && [ -d "$SCRIPT_DIR/configs" ]; then
   done
 fi
 
-# Run end-4 setup script with flags to skip unnecessary components
+# Run end-4 setup script with flags to skip unnecessary components.
+# SKIP_END4_SETUP=1 is a test hook used by tests/smoke.sh to validate this
+# script's own logic without running end-4's heavyweight installer.
 echo "WARNING: the end-4 installer runs with --force and --skip-backup;"
 echo "it may overwrite an existing Hyprland configuration without a backup."
-(
-  cd "$WORK_DIR/dots-hyprland"
-  ./setup install --force --skip-plasmaintg --skip-backup --skip-quickshell --skip-hyprland --skip-hyprland-entry
-)
+if [ "${SKIP_END4_SETUP:-0}" = "1" ]; then
+  echo "(SKIP_END4_SETUP=1 - skipping the end-4 installer)"
+else
+  (
+    cd "$WORK_DIR/dots-hyprland"
+    ./setup install --force --skip-plasmaintg --skip-backup --skip-quickshell --skip-hyprland --skip-hyprland-entry
+  )
+fi
 
 # Resolve a config file: prefer this repo's copy, fall back to the end-4 clone
 cfg_src() {