feat: add reproducible dev environment setup script

A freshly-cloned repo had no path to a working environment: building the
dev image, wiring git hooks, and installing VM tooling were all manual,
undocumented steps. This makes onboarding reproducible across machines.

scripts/setup-dev-environment.sh is idempotent and safe to re-run:
- Verifies OS, ensures Docker + docker group, starts daemon if needed
- Builds the knel-football-dev image
- Configures git hooks (SDLC enforcement)
- Creates output/ and tmp/ working dirs
- Installs VM tooling (libvirt/qemu/ovmf/swtpm) by default, since the
  ultimate artifact is an ISO that must be booted in a VM with serial
  capture to verify it works. --skip-vm opts out for build-only envs.
- Runs a smoke test (lint + unit tests) and prints a status summary

README "First-Time Setup" now points at this script instead of the
bare setup-githooks.sh step.

💘 Generated with Crush

Assisted-by: GLM-4.7 via Crush <crush@charm.land>

README.md

@@ -96,8 +96,12 @@ ls -lh output/
 
 ### First-Time Setup (After Cloning)
 ```bash
-# Configure git hooks (required for SDLC enforcement)
-./scripts/setup-githooks.sh
+# Full reproducible dev environment setup (Docker image, git hooks, smoke test)
+./scripts/setup-dev-environment.sh
+
+# VM testing tooling (libvirt/qemu/ovmf/swtpm) is installed by default so the
+# built ISO can be booted and verified. Skip it with --skip-vm if you only need
+# the build/test loop. Requires sudo for apt installs.
 ```
 
 ### SDLC Workflow (MANDATORY)