Harden scripts for non-interactive provisioning

- config/scripts/bw-load-ssh.sh: add ssh-agent retry loop (graphical
  session may not be ready when systemd fires); use process substitution
  instead of pipe to avoid subshell + set -e issues with LOADED counter
- stages/05-git.sh: remove interactive SSH key generation prompt (keys
  come from Bitwarden); pre-accept GitHub host key via ssh-keyscan
  to avoid first-connect prompt during git clone
- stages/04-shell.sh: add sudo chsh fallback (chsh may fail in
  non-interactive provisioning without PAM auth)

stages/04-shell.sh

@@ -92,8 +92,14 @@ fi
 # ---- Change default shell to zsh ----
 info "Setting zsh as default shell..."
 if [ "$SHELL" != "$(which zsh)" ]; then
-  chsh -s "$(which zsh)" 2>/dev/null || warn "Could not change shell (chsh)."
-  ok "Default shell set to zsh. Log out and back in to activate."
+  # Try chsh directly first, fallback to sudo chsh (for non-interactive provisioning)
+  if chsh -s "$(which zsh)" 2>/dev/null; then
+    ok "Default shell set to zsh. Log out and back in to activate."
+  elif sudo chsh -s "$(which zsh)" "$USER" 2>/dev/null; then
+    ok "Default shell set to zsh via sudo. Log out and back in to activate."
+  else
+    warn "Could not change shell (chsh). Run manually: chsh -s \"$(which zsh)\""
+  fi
 else
   ok "zsh is already the default shell."
 fi