Add dotfiles integration module (fedora-dots)

New modules/user/dotfiles.sh behind a menu question ('Clone personal
dotfiles?', default no) and --dotfiles=yes|no flag.

Does a --bare clone of yuri/fedora-dots into ~/.cfg.git, checks the repo
out into $HOME with status.showUntrackedFiles=no, and handles an empty
repo gracefully (configures the alias, skips checkout). Existing
~/.cfg.git is left untouched (idempotent).

Fix proven in the harness: the module originally used a plain git clone,
which creates a working copy and breaks the git-dir alias — the same
failure YuKu hit manually; --bare is required.
Dispatch runs the dotfiles module before DE/TWM so configs are in place
when sessions are installed.

modules/user/dotfiles.sh

@@ -0,0 +1,56 @@
+#!/bin/bash
+set -uo pipefail
+
+HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+# shellcheck source=../../lib/common.sh
+source "$HERE/../../lib/common.sh"
+
+if is_debug; then set +e; else set -e; fi
+
+DOTFILES_REPO="${DOTFILES_REPO:-https://git.ku-it.org/yuri/fedora-dots.git}"
+CFG_DIR="$HOME/.cfg.git"
+
+step "Personal dotfiles: fedora-dots"
+rule
+
+if [[ ! -d "$HOME/.config" ]]; then
+    mkdir -p "$HOME/.config"
+fi
+
+if [[ -d "$CFG_DIR" ]]; then
+    ok "Dotfiles already set up ($CFG_DIR exists). Skipping."
+    exit 0
+fi
+
+# A bare repo is the storage; $HOME is the work tree. Checkout happens through
+# the alias form, never a plain `git checkout` inside $HOME.
+info "Cloning dotfiles (bare) into $CFG_DIR..."
+# --bare is what makes ~/.cfg.git the storage; the plain clone YuKu first ran
+# created a working copy instead and broke the alias (proven the hard way).
+git clone --quiet --bare "$DOTFILES_REPO" "$CFG_DIR"
+
+cfg() {
+    git --git-dir="$CFG_DIR" --work-tree="$HOME" "$@"
+}
+
+# Empty repo (no commits yet): nothing to check out, but leave everything
+# configured so the first `cfg add` on this machine just works.
+if ! git --git-dir="$CFG_DIR" rev-parse --verify -q HEAD >/dev/null; then
+    warn "Dotfiles repo has no commits yet — checkout skipped."
+    warn "Add folders on your main machine first; here you can start fresh."
+    cfg config status.showUntrackedFiles no
+    ok "cfg alias ready: git --git-dir=$CFG_DIR --work-tree=$HOME"
+    exit 0
+fi
+
+info "Checking dotfiles out into \$HOME..."
+# -f on purpose: a fresh machine HAS stock files (e.g. .bashrc); the repo's
+# versions win on first setup. Untracked files are never touched.
+cfg checkout -f
+cfg config status.showUntrackedFiles no
+
+ok "Dotfiles checked out. Tracked paths:"
+git --git-dir="$CFG_DIR" ls-tree -r --name-only HEAD | cut -d/ -f1-2 | sort -u | sed 's/^/    /'
+
+info "Suggested shell alias for managing them:"
+info "    alias cfg='git --git-dir=$CFG_DIR --work-tree=\$HOME'"