System settings: optional SELinux disable; btrfs snapper + zstd compression

New section between base and DE menus:
- 'Disable SELinux permanently?' — default no; writes SELINUX=disabled with a
  backup, warns about the security tradeoff.
- When / is btrfs: 'snapper + grub-btrfs + compression?' — default yes. Shows
  subvolume list + fstab, appends ,compress=zstd:1 to btrfs fstab entries that
  lack a compress= option (idempotent, fstab backed up), then runs the
  SysGuides sysguides-snapper-fedora installer (snapper root+home, grub-btrfs,
  DNF5 pre/post snapshot actions).
- Flags for unattended runs: --selinux=keep|disabled, --snapper=yes|no.
- Fix found by the harness: the flag initializers sat after the arg loop and
  wiped parsed values; --snapper=no was silently ignored. Initializers moved
  before the loop.
README + section renumbering updated.

README.md

@@ -83,6 +83,26 @@ compositors — do not expect the same config story from it.
   Wayland compositors *and* X11 sessions in one menu.
 * Either way `graphical.target` becomes the default.
 
+
+## System settings
+
+Between base setup and the DE menu, the script asks two questions:
+
+1. **Disable SELinux permanently?** — default **no**. Writes `SELINUX=disabled`
+   to `/etc/selinux/config` (backup kept); a reboot applies it. Recommended
+   answer is no.
+2. **Snapper + grub-btrfs + zstd compression** — only asked when `/` is btrfs,
+   default **yes**. Runs, in order:
+   - `btrfs subvolume list /` and the fstab btrfs entries are shown
+   - every fstab btrfs entry with a `subvol=` but no `compress=` gets
+     `,compress=zstd:1` appended (fstab backed up first; re-runs cannot stack
+     duplicate options)
+   - the [SysGuides installer](https://github.com/SysGuides/sysguides-snapper-fedora)
+     sets up snapper (root + home), grub-btrfs, and DNF5 pre/post snapshot hooks,
+     so every `dnf` transaction is snapshotted and `snapper undochange` works.
+
+Unattended equivalents: `--selinux=keep|disabled` and `--snapper=yes|no`.
+
 ## Design rules
 
 1. **Fail loudly, early.** `set -e` is on unless `--debug`. Unsupported distro,