fix: dotup — installer, picker and private-tier correctness pass

Installer:
- channel order is a dependency graph: `script` now runs before `brew`, so
  core/brew exists by the time lazygit, omp and herdr are attempted. Those
  three have no apt package at all and failed on every fresh Linux box.
- core/brew and core/node are real script/tarball rows now. apt's nodejs is
  18.19 while four npm rows declare node>=20; npm only warns on a failed
  engines check, so the install "succeeded" and `pi` then died at parse time.
- apt_known asks `apt-cache policy` for an installation candidate rather than
  `apt-cache show` for existence: docker-ce exists in the cache with
  `Candidate: (none)` and exits 0, which kept it in the batch and made apt
  refuse all thirty packages at once.
- failures are reported by manifest key, not by install argument, so the name
  in the summary is one you can type at the picker or pass to `dotup explain`.
- flatpak installs the tool, adds the flathub remote, and uses --user, which
  is the only scope that works without a session bus.
- gh: deb assets fill %a and %v, because a distro-targeted deb names the
  release as well as the arch (ghostty-ubuntu).
- ensure_bws downloads into a `mktemp -d` instead of fixed /tmp paths.
- the endpoint password prompt says so out loud when stty cannot turn echo off,
  instead of silently leaving the password in the scrollback.
- cmd_toggle writes tmp-then-rename, matching cmd_expand.

Picker:
- DU-C1: comments had been inserted between the continued lines of the fzf
  invocation. The `\`-newline is stripped first, so the comment's own newline
  terminated the command — fzf ran with two binds and the lines below it ran
  as a command named `--bind`, so `dotup pick` returned 1 having drawn a dead
  picker. The comment now sits above the pipeline.
- the header is built with a plain variable: `$'...'` is a bashism and /bin/sh
  on Ubuntu is dash, the one platform this is written for.
- the /dev/tty probe runs BEFORE the defaults preset, so a run in a pipe no
  longer overwrites the selection with 43 rows before failing to draw.
- a completed pick is recorded in $STATE/picked, so "install nothing" survives
  the next run and a prior `dotup plan` no longer counts as having chosen.
- $SEL must be readable and writable before anything draws: every bind is
  execute-silent, which throws its child's status away.
- ensure_fzf resolves system-first, cache-second, as the README promises.
- ^t clears the query, so rows pulled in along @needs are on screen.

dot_local/share/dotup/packages.tsv

@@ -30,6 +30,13 @@
 @needs	agents/pi-plugins	agents/pi
 @needs	agents/specify-cli	core/uv
 @needs	core/mermaid-cli	core/node
+# The three rows with no apt package at all. They resolved to brew and
+# nothing installed brew, so `^a` ticked them and they failed on every
+# fresh Linux box. On Linux brew lives entirely under
+# /home/linuxbrew/.linuxbrew, which find_tool already probes.
+@needs	core/lazygit	core/brew
+@needs	agents/omp	core/brew
+@needs	agents/herdr	core/brew
 @needs	core/neovim	core/imagemagick core/mermaid-cli
 @needs	private/bws-secrets	core/unzip
 #
@@ -43,7 +50,7 @@
 @spec	core/bitwarden-cli	bw
 @spec	apps/obsidian	md.obsidian.Obsidian
 @spec	apps/chrome	https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb
-@spec	apps/ghostty	gh:mkasberg/ghostty-ubuntu:_amd64.deb
+@spec	apps/ghostty	gh:mkasberg/ghostty-ubuntu:_%a_%v.deb
 core	neovim	safe	-tarball	neovim	apt ships 0.9.5 — tarball to /opt/nvim
 core	ripgrep	safe	ripgrep	ripgrep	binary is rg
 core	fd	safe	fd-find	fd	binary is fdfind on ubuntu
@@ -58,7 +65,8 @@ core	gh	safe	gh	gh
 core	chezmoi	safe	-script	chezmoi	bootstrap cannot come from the manifest
 core	go	safe	-tarball	go	/usr/local/go on linux
 core	uv	safe	-script	uv	astral installer to ~/.local/bin
-core	node	safe	nodejs npm	node	apt's nodejs ships node WITHOUT npm — both names needed
+core	brew	safe	-script	-builtin	linuxbrew — the only source for lazygit, omp and herdr
+core	node	safe	-tarball	node	apt ships 18.19 and the npm rows below need 20+ — tarball to /opt/node
 core	imagemagick	safe	imagemagick	imagemagick	required by the nvim markdown render path
 core	mermaid-cli	safe	-npm	-npm	mmdc — nvim renders mermaid fences with it
 core	btop	safe	btop	btop