fix: v0.2.3 e2e distro loop, FIDO2 freeze, grouped prompts

Fix e2e.sh distro iteration broken by IFS setting (use bash array).
Fix FIDO2 detection freezing on macOS (check ssh-sk-helper, don't
invoke ssh-keygen). Group apply prompts into 6 categories. Fix Linux
gitleaks install hint.

Co-Authored-By: Claude <noreply@anthropic.com>

test/e2e.sh

@@ -18,8 +18,8 @@ readonly REPO_ROOT
 readonly CONTAINER_DIR="${SCRIPT_DIR}/containers"
 readonly IMAGE_PREFIX="git-harden-test"
 
-# Distro matrix: name=image
-readonly DISTROS="ubuntu debian fedora alpine arch"
+# Distro matrix
+readonly DISTROS=(ubuntu debian fedora alpine arch)
 
 # Colors (empty if not a terminal)
 if [ -t 2 ]; then
@@ -314,19 +314,19 @@ main() {
     if [ -n "$TARGET_DISTRO" ]; then
         # Validate distro name
         local valid=false
-        for d in $DISTROS; do
+        for d in "${DISTROS[@]}"; do
             if [ "$d" = "$TARGET_DISTRO" ]; then
                 valid=true
                 break
             fi
         done
         if [ "$valid" = false ]; then
-            die "Unknown distro: ${TARGET_DISTRO}. Available: ${DISTROS}"
+            die "Unknown distro: ${TARGET_DISTRO}. Available: ${DISTROS[*]}"
         fi
 
         run_distro "$TARGET_DISTRO"
     else
-        for d in $DISTROS; do
+        for d in "${DISTROS[@]}"; do
             run_distro "$d"
         done
     fi