Fix setup safety issues found in review

[seungwonme]

What changed

• keep the beginner Git defaults (Claude Code / noreply@anthropic.com) and explain when they are used
• preserve complete share links, including the OTEL header value, so students do not need to enter configuration manually
• disable script copy, download, and one-line execution when no tools are selected
• reject Windows Store Python aliases, distinguish Docker Desktop from a Docker CLI, and report Codex telemetry write failures
• create private random runner files and remove those internal temp copies after macOS/Windows one-line execution

Why

This service is for non-developers starting vibe coding. Setup links should work without requiring students to understand Git identity or OTEL credentials, while generated installers should report the applications that are actually installed.

The temporary runner files are internal copies created only by the one-line terminal commands. Downloaded setup files are unchanged and remain on disk.

User impact

• fresh users can commit with the existing beginner Git defaults
• instructor-configured OTEL links carry the full configuration
• empty selections cannot produce runnable output
• Windows installation status is more accurate
• one-line runner payloads do not remain in the temp directory after execution

Validation

• pnpm test
• pnpm build
• pnpm test:e2e — 5/5
• generated macOS script parsed with bash -n
• generated Windows payload parsed with PowerShell

Actual WinGet/Homebrew package installation was intentionally not run because it would modify the host system.

Repository branch protection is an external GitHub setting and is not part of this code diff.