feat: add e2e container test harness

Implements spec docs/specs/2026-03-30-e2e-container-tests.md:
- 5 Containerfiles (ubuntu, debian, fedora, alpine, arch)
- test/e2e.sh runner with --runtime, --rebuild, single-distro mode
- tmux-based interactive tests (full accept, safety gate decline,
  signing generate, signing skip)
- All scripts pass shellcheck

Closes: #18, #19, #20

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

test/interactive/test-safety-gate-decline.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# Interactive test: decline safety review gate
+# Verifies: script exits 0, prints AI review instructions, no config changes
+
+set -o errexit
+set -o nounset
+set -o pipefail
+IFS=$'\n\t'
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+# shellcheck source=helpers.sh
+source "${SCRIPT_DIR}/helpers.sh"
+
+main() {
+    trap cleanup EXIT
+
+    printf 'Test: Safety gate decline\n' >&2
+
+    # Snapshot current config
+    local config_before
+    config_before="$(git config --global --list 2>/dev/null || true)"
+
+    start_session
+
+    # Safety review gate — answer no (default)
+    wait_for "reviewed this script"
+    send "n" Enter
+
+    # Wait for exit
+    sleep 2
+    local output
+    output="$(capture_output)"
+
+    # Verify: output contains AI review instructions
+    assert_contains "$output" "claude"
+    assert_contains "$output" "gemini"
+
+    # Verify: no config changes
+    local config_after
+    config_after="$(git config --global --list 2>/dev/null || true)"
+    if [ "$config_before" = "$config_after" ]; then
+        pass "Safety gate decline: no config changes, instructions shown"
+    else
+        fail "Safety gate decline: config was modified"
+        exit 1
+    fi
+}
+
+main