feat: set the active display color profile to sRGB (post-install helper)

[DevSecNinja]

What

Add a post-install helper to set the active display's color profile to sRGB (accurate color
rather than the oversaturated "Vivid"), applied to the currently active monitor.

Why

sRGB is the accurate default that matters for screenshots, docs, and design work; "Vivid" just
oversaturates. Requested as part of the opinionated setup.

Why it is not a plain catalog entry

The desktop/display color profile is a per-display ICC association (Windows Color System), not a
single portable registry value — it depends on the connected monitor (EDID). So it fits the
online post-install path as a small helper rather than an offline image tweak.

Proposed approach

• Add a private, mockable seam over Windows Color System, e.g.:
  • PowerShell Add-ColorProfile / Set-ColorProfile where available, or
  • colorcpl.exe / the WCS APIs (WcsAssociateColorProfileWithDevice), or the documented
    colorcpl associations under HKLM\SYSTEM\...\Control\Class\{Display}\....
• Target the active display (primary monitor) by default; make the target selectable.
• Associate the standard sRGB Color Space Profile.icm (ships with Windows) and set it as the
  default device profile.
• Opt-in switch on Invoke-PostInstallSetup / post-install.ps1 (e.g. -SetSrgbColorProfile),
  default off. Idempotent (skip if already associated + default), -WhatIf previews.
• Tests mock the seam (already-sRGB → AlreadyApplied; other → Applied; no display → NotApplicable).

Notes

• Per-display + machine-specific, so it is intentionally NOT part of the portable offline image.
  (See the chezmoi-boundary issue: this could alternatively live in the dotfiles run-scripts.)