System settings: optional SELinux disable; btrfs snapper + zstd compression

New section between base and DE menus:
- 'Disable SELinux permanently?' — default no; writes SELINUX=disabled with a
  backup, warns about the security tradeoff.
- When / is btrfs: 'snapper + grub-btrfs + compression?' — default yes. Shows
  subvolume list + fstab, appends ,compress=zstd:1 to btrfs fstab entries that
  lack a compress= option (idempotent, fstab backed up), then runs the
  SysGuides sysguides-snapper-fedora installer (snapper root+home, grub-btrfs,
  DNF5 pre/post snapshot actions).
- Flags for unattended runs: --selinux=keep|disabled, --snapper=yes|no.
- Fix found by the harness: the flag initializers sat after the arg loop and
  wiped parsed values; --snapper=no was silently ignored. Initializers moved
  before the loop.
README + section renumbering updated.

lib/common.sh

@@ -201,3 +201,85 @@ install_nerd_font() {
     fc-cache -f "$dest" >/dev/null 2>&1 || true
     ok "Nerd Font ${family} installed to $dest"
 }
+
+
+#------------------------------------------
+# System: SELinux, Btrfs, snapper
+#------------------------------------------
+# Permanently disable SELinux. Destructive-ish: warn loudly, and remind the
+# user a reboot is needed for the change to take effect.
+disable_selinux() {
+    # FSTAB/SELINUX file overridable for testing on non-Fedora hosts
+    local cfg="${SELINUX_CONFIG:-/etc/selinux/config}"
+    if [[ -f "$cfg" ]] && grep -q '^SELINUX=disabled' "$cfg"; then
+        ok "SELinux already disabled in $cfg."
+        return 0
+    fi
+    warn "Disabling SELinux permanently. This removes a significant layer of"
+    warn "system protection. Only do this if you specifically need it."
+    if [[ -f "$cfg" ]]; then
+        sudo cp "$cfg" "${cfg}.bkp.$(date +%F)"
+        sudo sed -i 's/^SELINUX=.*/SELINUX=disabled/' "$cfg"
+    else
+        printf 'SELINUX=disabled\nSELINUXTYPE=targeted\n' | sudo tee "$cfg" >/dev/null
+    fi
+    ok "SELINUX=disabled written to $cfg (backup saved). Reboot to apply."
+}
+
+# Show the btrfs layout, then make sure every btrfs fstab entry compresses
+# with zstd. The sed variant from the SysGuides guide appends ,compress=zstd:1
+# after the subvol= option; we guard it so re-runs cannot stack duplicates.
+ensure_btrfs_compression() {
+    local fstab="${FSTAB_FILE:-/etc/fstab}"
+    info "Current btrfs subvolumes on /:"
+    sudo btrfs subvolume list / 2>/dev/null | sed 's/^/    /' || warn "btrfs subvolume list failed (not btrfs?)"
+
+    info "fstab btrfs entries:"
+    grep ' btrfs ' "$fstab" | sed 's/^/    /' || true
+
+    local fixed=0 line
+    # Only touch btrfs lines that have a subvol= option and no compress= yet.
+    while IFS= read -r line; do
+        if grep -q ' btrfs ' <<<"$line" && grep -q 'subvol=' <<<"$line" && ! grep -q 'compress=' <<<"$line"; then
+            fixed=$((fixed+1))
+        fi
+    done < "$fstab"
+
+    if (( fixed == 0 )); then
+        ok "All btrfs fstab entries already carry a compress= option (or none exist)."
+        return 0
+    fi
+
+    info "Adding compress=zstd:1 to ${fixed} btrfs fstab entrie(s)..."
+    # Backup once per run, then apply the SysGuides sed to every qualifying line.
+    sudo cp "$fstab" "$fstab.bkp.$(date +%F-%H%M)"
+    sudo sed -i '/ btrfs / s/subvol=[^ ,]*/&,compress=zstd:1/' "$fstab"
+    ok "fstab updated. Remount or reboot for compression to take effect:"
+    info "    sudo mount -o remount /  &&  sudo mount -o remount /home"
+}
+
+# Full snapshot setup via the SysGuides installer (snapper + grub-btrfs +
+# DNF5 pre/post snapshot actions). The installer re-validates btrfs itself.
+setup_snapper() {
+    if pkg_installed snapper && [[ -d /.snapshots ]]; then
+        ok "Snapper already configured (config for / exists)."
+        return 0
+    fi
+    if ! findmnt -n -o FSTYPE / 2>/dev/null | grep -q btrfs; then
+        warn "Root filesystem is not btrfs; skipping snapshot setup."
+        return 0
+    fi
+    info "Setting up snapper + grub-btrfs (SysGuides installer)..."
+    local tmp
+    tmp=$(mktemp -d)
+    git clone --depth 1 https://github.com/SysGuides/sysguides-snapper-fedora "$tmp/sysguides" \
+        || { err "Could not clone the SysGuides installer."; rm -rf "$tmp"; return 1; }
+    ( cd "$tmp/sysguides" && ./install.sh )
+    local rc=$?
+    rm -rf "$tmp"
+    if (( rc == 0 )); then
+        ok "Snapper + grub-btrfs installed. Every dnf transaction now gets a pre/post snapshot."
+        info "Try it:  snapper ls   |   snapper status 1..2   |   sudo snapper undochange 1..2"
+    fi
+    return $rc
+}