chore: add Amp orb setup script

[acramatte]

Why

Fresh Amp orbs (Debian 12) start without rustup, the pinned Node version, or the native desktop prerequisites, so agents reinstall them in every thread. .agents/setup runs once per fresh orb, and Amp snapshots the result, so later orbs start ready.

How

.agents/setup is non-interactive and idempotent. It:

• installs the apt packages the CI package job uses (WebKitGTK, GTK, Xvfb, webkit2gtk-driver, …), skipping any already present;
• installs rustup and the toolchain pinned in rust-toolchain.toml (1.93.1);
• installs Node 24.18.0 (per docs/phase4.md/CI) and git-cliff 2.14.1 (per mise.toml), both checked against pinned checksums;
• adds the toolchains to PATH once in ~/.bash_profile, so login shells and supervised services see them;
• runs npm ci in apps/desktop, then cargo fetch and pre-builds core/CLI (build and clippy);
• installs tauri-driver 2.0.6.

The desktop crate is not pre-built (that adds ~2m40s). .gitignore now ignores .amp/portals/*.

Tests

In an Amp orb:

• Cold .agents/setup: exit 0, 1m50s.
• Warm rerun: exit 0, 3.6s; the ~/.bash_profile block appears once.
• Clean env -i … bash -lc login shell: node v24.18.0, rustc 1.93.1, git-cliff, tauri-driver, WebKitWebDriver, Xvfb all resolve; cargo test --locked -p notes-core -p notes-cli --all-features passes; npm run typecheck passes.
• cargo test --locked -p notes-desktop --no-run builds after setup (not part of the script).