fix(shell-setup): set default shell without a password prompt

A bare `chsh -s /usr/bin/zsh` authenticates the calling user through PAM and
prompts "Password:", stalling an unattended install right after oh-my-zsh.
Run it via `sudo chsh ... "$(whoami)"` so it uses the passwordless setup sudo
rule and completes silently (also more reliable: it targets the account
explicitly rather than relying on the ambient user).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01R5kHioUMK3mtf2eiLEozCM

setup/modules/shell-setup.sh

@@ -260,11 +260,15 @@ fi
 
 # ── Default shell change ───────────────────────────────────────────────────────
 # WHY: New login shells still default to bash unless explicitly changed.
-#      `chsh` writes the new shell to /etc/passwd for this user.
+#      This writes the new shell to /etc/passwd for this user.
 # HOW: Compare current $SHELL to /usr/bin/zsh and change if different.
+#      Use `sudo chsh` (not bare `chsh`): a bare chsh authenticates the calling
+#      user via PAM and prompts "Password:", which hangs an unattended install.
+#      Routing through sudo uses the passwordless setup rule, so it runs silently;
+#      `whoami` targets the right account whether run as the user or via runuser.
 if [ "$SHELL" != "/usr/bin/zsh" ]; then
     log "Setting zsh as default shell..."
-    chsh -s /usr/bin/zsh
+    sudo chsh -s /usr/bin/zsh "$(whoami)"
 else
     skip "zsh is already the default shell."
 fi