docs: refresh README for AI agents and point to manifest-driven dot/ CLI

[zhuochun]

Motivation

• Make the repository setup instructions explicit and machine/AI-agent friendly by calling out the maintained, manifest-driven dot/ CLI as the primary setup path.
• Reduce accidental destructive actions by documenting dry-run defaults and --apply requirements for restores and local restores.
• Provide an actionable Quick Start and validation checklist so automation can perform safe, repeatable installs on macOS.

Description

• Rewrote README.md to add an AI Agent Quick Start with repository rules (clone path expectations, secrets policy, macOS enforcement, and preferred entrypoints).
• Clarified the command reference for dot/dot and dot/local, documented manifest-driven behavior, dry-run defaults, conflict policies, and rollback snapshot locations.
• Updated the Fresh macOS Setup Checklist and Validation Checklist to separate Homebrew bundle installation from dot/dot setup, and to include explicit commands for common post-setup steps (Zsh, oh-my-zsh, TPM, Neovim plugin install, GUI app permissions).
• Demoted legacy scripts/* as non-primary helpers and updated other topical sections (Tmux, Karabiner, Espanso, Rime, Windows AutoHotkey, Vim/Neovim, custom scripts, fonts, themes, Atom note).

Testing

• Ran shell syntax checks: bash -n dot/dot dot/local dot/lib/common.sh dot/lib/symlink.sh (passed).
• Performed README sanity checks with Python to validate code-fence balance and presence of key headings (passed).
• Executed ./dot/local backup --dry-run --verbose to verify local backup dry-run behaviour (passed, produced dry-run logs).
• Executed ./dot/dot setup --dry-run --verbose to verify setup flow, which signalled the expected macOS-only guard in this non-macOS container (noted as environment limitation).
• Attempted zsh -n zshrc zshenv but zsh is not installed in the test container (noted as environment limitation).

---

Codex Task