System settings: optional SELinux disable; btrfs snapper + zstd compression

New section between base and DE menus:
- 'Disable SELinux permanently?' — default no; writes SELINUX=disabled with a
  backup, warns about the security tradeoff.
- When / is btrfs: 'snapper + grub-btrfs + compression?' — default yes. Shows
  subvolume list + fstab, appends ,compress=zstd:1 to btrfs fstab entries that
  lack a compress= option (idempotent, fstab backed up), then runs the
  SysGuides sysguides-snapper-fedora installer (snapper root+home, grub-btrfs,
  DNF5 pre/post snapshot actions).
- Flags for unattended runs: --selinux=keep|disabled, --snapper=yes|no.
- Fix found by the harness: the flag initializers sat after the arg loop and
  wiped parsed values; --snapper=no was silently ignored. Initializers moved
  before the loop.
README + section renumbering updated.

setup.sh

@@ -19,6 +19,8 @@ DEBUG_MODE=false
 ASSUME_YES=false
 DE=""
 TWM=""
+SELINUX_OPT=""
+SNAPPER_OPT=""
 
 usage() {
     cat <<'EOF'
@@ -32,6 +34,8 @@ Usage:
 Options:
   --de=NAME     gnome | plasma | xfce | none
   --twm=NAME    chadwm | hyprland | mango | niri | none
+  --selinux=X   keep | disabled   (asked, default keep)
+  --snapper=X   yes | no          (asked when / is btrfs, default yes)
   -y, --yes     never prompt (requires --de and --twm)
   -d, --debug   pause after each section instead of aborting on error
   -h, --help    show this help
@@ -53,6 +57,8 @@ for arg in "$@"; do
         -d|--debug) DEBUG_MODE=true ;;
         -y|--yes)   ASSUME_YES=true ;;
         --de=*)     DE="${arg#*=}" ;;
+        --selinux=*) SELINUX_OPT="${arg#*=}" ;;
+        --snapper=*) SNAPPER_OPT="${arg#*=}" ;;
         --twm=*)    TWM="${arg#*=}" ;;
         -h|--help)  usage; exit 0 ;;
         *)
@@ -201,8 +207,62 @@ ask_choice() {
     done
 }
 
+# Ask a yes/no question; $2 is the default (yes|no). Honours --yes.
+ask_yes_no() {
+    local prompt="$1" default="$2" answer
+    if [[ "$ASSUME_YES" == "true" ]]; then
+        echo "$default"
+        return 0
+    fi
+    while true; do
+        read -t 60 -rp "$prompt [y/n] (default: $default): " answer || printf "\n"
+        answer="${answer,,}"
+        [[ -z "$answer" ]] && answer="$default"
+        case "$answer" in
+            y|yes) echo "yes"; return 0 ;;
+            n|no)  echo "no";  return 0 ;;
+        esac
+        err "Please answer y or n."
+    done
+}
+
 #------------------------------------------
-# 3 Desktop environment selection
+# 3 System settings
+#------------------------------------------
+SELINUX_DISABLED=false
+BTRFS_SNAPPER=false
+
+if [[ -z "$SELINUX_OPT" ]]; then
+    step "3 System settings"
+    rule
+    printf "\n"
+    printf "\n"
+    choice=$(ask_yes_no "Disable SELinux permanently? (not recommended)" "no")
+    [[ "$choice" == "yes" ]] && SELINUX_DISABLED=true
+    printf "\n"
+    if findmnt -n -o FSTYPE / 2>/dev/null | grep -q btrfs; then
+        ok "Root filesystem is btrfs — snapshot support is available."
+        choice=$(ask_yes_no "Set up snapper + grub-btrfs snapshots and zstd compression?" "yes")
+        [[ "$choice" == "yes" ]] && BTRFS_SNAPPER=true
+    else
+        info "Root filesystem is not btrfs; skipping snapshot setup."
+    fi
+fi
+
+case "${SELINUX_OPT:-}" in
+    disabled) SELINUX_DISABLED=true ;;
+    keep|"")  : ;;
+    *) err "Unknown --selinux value: '$SELINUX_OPT' (keep|disabled)"; exit 2 ;;
+esac
+case "${SNAPPER_OPT:-}" in
+    yes)   BTRFS_SNAPPER=true ;;
+    no|"") : ;;
+    *) err "Unknown --snapper value: '$SNAPPER_OPT' (yes|no)"; exit 2 ;;
+esac
+pause_if_debug
+
+#------------------------------------------
+# 4 Desktop environment selection
 #------------------------------------------
 if [[ -z "$DE" ]]; then
     step "3 Desktop environment"
@@ -232,10 +292,10 @@ esac
 pause_if_debug
 
 #------------------------------------------
-# 4 Tiling window manager selection
+# 5 Tiling window manager selection
 #------------------------------------------
 if [[ -z "$TWM" ]]; then
-    step "4 Tiling window manager"
+    step "5 Tiling window manager"
     rule
     printf "\n"
     echo "  1) Niri       (Wayland, scrollable)"
@@ -290,6 +350,17 @@ run_module() {
 step "5 Installation"
 rule
 
+if [[ "$SELINUX_DISABLED" == "true" ]]; then
+    disable_selinux
+    pause_if_debug
+fi
+
+if [[ "$BTRFS_SNAPPER" == "true" ]]; then
+    ensure_btrfs_compression
+    setup_snapper
+    pause_if_debug
+fi
+
 if [[ "$DE" != "none" ]]; then
     run_module "$SCRIPT_DIR/modules/de/${DE}.sh"
     pause_if_debug
@@ -303,10 +374,11 @@ fi
 #------------------------------------------
 # 6 Done
 #------------------------------------------
-step "6 Summary"
+step "7 Summary"
 rule
 ok "DE:  $DE"
 ok "TWM: $TWM"
+ok "SELinux: $([[ "$SELINUX_DISABLED" == "true" ]] && echo disabled || echo keeping)"; ok "Btrfs snapshots: $([[ "$BTRFS_SNAPPER" == "true" ]] && echo yes || echo skipped)"
 DM=$(detect_display_manager)
 ok "Display manager: ${DM:-none}"