Add transactional setup install and update commands

[computerality]

Summary

• replace the separate misc plugin install and misc skill install paths with unified setup install and setup update commands
• add read-only planning, existing-mode preservation, custom-location confirmation, and transactional stage/commit/rollback behavior
• validate all destinations before mutation, including nested targets, bundled-source overlap, symlinked parent aliases, and case-insensitive filesystem aliases
• keep copy-install filtering aligned with doctor, and update the README and bundled skill guidance for the new command surface

Behavior

idac setup install installs the GUI bridge and both agent skills by default, and refuses existing destinations before changing anything. idac setup update refreshes existing targets and installs missing ones while preserving their modes unless --mode is specified.

Default idac-owned destinations update directly, including from non-interactive agent contexts. Replacing an existing explicit --plugin-dir or --skill-dest target requires confirmation; automation can inspect --dry-run and apply the reviewed plan with --force. Structural validation cannot be bypassed.

The old installer commands under misc are intentionally removed rather than retained as hidden compatibility aliases.

Safety

• all targets are validated and staged before the first destination is changed
• replacements use sibling backups and roll back in reverse order on OSError, KeyboardInterrupt, or other base exceptions
• transaction state is recorded before filesystem replacement calls so interrupts cannot escape bookkeeping
• post-commit backup cleanup failures are reported as warnings without misreporting a committed update as failed
• plugin reload guidance is emitted only when a plugin target actually changed

Testing

• make check (560 passed, 1 skipped; lint, type checking, and dependency audit clean)
• focused setup/CLI suite (146 passed)

Closes #16