Add non-mutating --dry-run preflight and testable installer parameters

[xnoto]

Summary

Adds a non-mutating --dry-run preflight mode to set_dns.py and makes install.py testable, per the authorized task design:

• set_dns.py gains argparse-based CLI parsing with optional --dry-run and --config PATH. Dispatcher positional arguments (interface/action) are preserved and normal behavior is unchanged when --dry-run is omitted. Dry run validates root-volume config selection/parsing, the local IPv4, dispatcher arguments, and the derived FQDN, prints the intended reconciliation, and returns success without constructing a Cloudflare client or making any API call.
• install.py install() gains optional source_dir, dispatcher_path, and config_files parameters. Production constants, default paths, root check, alias priority, ownership (0:0), and modes (0700/0600) are unchanged.
• Tests prove dry-run avoids client construction, reports the intended action, honors --config, preserves dispatcher arguments, and that the installer prefers cflan_-prefixed config, keeps legacy aliases valid, applies expected ownership/modes, and fails on missing dispatcher directory or non-root execution — all with tmp_path and mocks.
• README/CONTRIBUTING document --dry-run precisely: it never constructs a Cloudflare client or calls the Cloudflare API; for an encrypted selected config (cflan_sops_vars.yaml/sops_vars.yaml) it does invoke SOPS locally, exercising SOPS/key availability without writing plaintext to disk; and it does not install or execute the actual NetworkManager dispatcher hook.

Type of change

• Feature / enhancement
• Documentation

Validation

• Required pull-request checks pass (lint/test matrix 3.10–3.13, mypy, wheel build — reported on this PR)
• Generated or centrally distributed files were regenerated by their owning automation, not hand-edited (no generated files touched)

Intentionally not validated: live host installation, NetworkManager dispatcher execution, and Cloudflare API behavior — out of scope and unchanged.

Impact and rollout

None beyond this repository. Source-only change; no version bump, no release, no GitOps or runtime impact. Existing installations are unaffected until they choose to upgrade. --dry-run never contacts the Cloudflare API and does not install or execute the NetworkManager dispatcher hook; for an encrypted selected config it invokes SOPS locally (in-process plaintext only, never written to disk).

Safety and secrets

• Contains no plaintext secrets, decrypted SOPS values, state files, kubeconfigs, tokens, or private endpoints (all test fixtures use placeholder values such as test-token; changed content was inspected for secrets before commit)
• No local OpenTofu init/plan/apply/destroy/import/state operations were run or claimed — plans come from pull-request checks
• Breaking or irreversible effects are described above with rollback notes (none; rollback is reverting this PR)

This change was produced by an AI agent per an authorized task specification; scope was fixed by the requester.