Refactor: modular layout, English-only, install primitives, CI

[WhiteMuush]

Summary

Ghostline is restructured from a single 681-line ghostline.sh into a
modular layout that's easier to extend and review. No new menu entries —
every legacy feature is preserved, just behind a cleaner facade.

What changed

• lib/core.sh — TTY-aware colors (no more ANSI in pipes), palette,
  GHOSTLINE_* globals.
• lib/installer.sh — log_*, prompt_*, ensure_command,
  resolve_command, clone_or_pull, pip_install, pipx_install.
  Shared by the runtime and install.sh.
• lib/ui.sh — ASCII art, menu rendering, splash screen. Fragile
  IFS=$'\n' read -r -d '' array splitting replaced by mapfile -t.
• lib/modules/{config,passive,active,special}.sh — one file per
  enumeration domain. Each tool follows a five-line shape:
  require_* checks → ensure_command → run → save → continue.
• ghostline.sh — thin entry point (~50 lines) that sources the
  library and drives the main loop.
• install.sh — translated to English, uses the shared helpers,
  fixed quoting on chown, replaced eval echo ~$SUDO_USER with
  getent passwd.

Hardening

• set -uo pipefail at the entry point (interactive — -e would kill
  the loop on the first non-zero exit). install.sh uses the full
  set -euo pipefail since it is non-interactive.
• TTY-aware color palette: pipes get plain text, terminals get colors.
• Every variable expansion is quoted.
• mapfile -t everywhere instead of the fragile legacy splitting.
• resolve_command for binaries packaged under multiple names
  (crackmapexec / cme / nxc).

New project plumbing

• LICENSE (MIT), .gitignore, .editorconfig.
• CONTRIBUTING.md, CODE_OF_CONDUCT.md, SECURITY.md.
• docs/ARCHITECTURE.md — layout, boot sequence, helpers, CI.
• docs/ADDING_A_TOOL.md — recipe for plugging in a new tool.
• .github/workflows/ci.yml — shellcheck + bash -n + smoke test.
• .github/ISSUE_TEMPLATE/ (bug report + tool request) and
  PULL_REQUEST_TEMPLATE.md.
• Readme.md renamed to README.md with badges, Project Layout
  section, and the unimplemented "PowerShell coming soon" line removed.

Test plan

• bash -n passes on every .sh (entry point, install, lib/, modules).
• Source-chain smoke test: 47 expected functions defined after
  sourcing the full lib/ tree.
• CI workflow exercises the same three checks (shellcheck +
  bash -n + smoke).
• Manual run on a lab AD (passive workflow, active workflow,
  secrets dump) — to be done before tagging v1.0.0.