Add Silverblue/ostree install support

[hzs0084]

Summary

Add Fedora Silverblue/ostree install support to setup.sh.

• Detect immutable hosts and install to writable locations.
• Preserve existing behavior for non-ostree distros.
• Add safe dev toggles for container/CI testing and fix the shebang to venv python.
• Harden the installer by avoiding eval and handling sudo sanely.

Fixes #4.

---

Problem

On Fedora Silverblue, /usr is immutable. The current installer writes under /usr and expects distro-specific systemd paths, so it fails on ostree/immutable systems.

---

Solution (what this PR changes)

• Ostree/immutable detection:
  Check /run/ostree-booted, and fall back to a write test under /usr.
• Install locations on Silverblue:
  • Binary → /usr/local/bin/ukip
  • Systemd unit → /etc/systemd/system/ukip.service
  • Venv/state → /var/usrlocal/ukip/.venv
  • Config → /etc/ukip/*
• Non-ostree behavior preserved:
  • Binary → /usr/bin/ukip
  • Systemd unit → /usr/lib/systemd/system (or /lib/systemd/system when DEBIAN=true)
  • Venv/state → /var/lib/ukip/.venv
• Dev ergonomics / safety:
  • DRY_RUN — print actions only
  • NO_SYSTEMD — skip systemctl calls (useful in containers)
  • INSTALL_PY_DEPS — skip Python dependency install during iteration
  • OSTREE_FORCE — simulate immutable path anywhere
  • Root-aware sudo helper (no sudo when already root)
  • Safe run() wrapper (no eval, prevents arg mangling)
  • Shebang rewrite points to venv python: #!/…/.venv/bin/python3

---

Paths (at a glance)

Environment	Binary	Systemd unit	Venv/state	Config
Silverblue / ostree	/usr/local/bin/ukip	/etc/systemd/system/ukip.service	/var/usrlocal/ukip/.venv	/etc/ukip/*
Other distros (default)	/usr/bin/ukip	/usr/lib/systemd/system/ukip.service or /lib/systemd/system/ukip.service (Debian)	/var/lib/ukip/.venv	/etc/ukip/*

---

Build dependencies (Fedora)

gcc python3-devel kernel-headers (needed for building evdev):

dnf -y install gcc python3-devel kernel-headers


### Verification

**Container (Fedora 40) — immutable path, skipping systemd**
```bash
NO_SYSTEMD=1 INSTALL_PY_DEPS=0 OSTREE_FORCE=1 bash ./setup.sh

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.