fix: harden Claude Code integration, add dps theme, de-dup wiring

[mr-kumuditha]

Bug-fix, cleanup, and security-hardening pass on the Claude Code
integration. Bumps version 1.2.0 -> 1.3.0 across all manifests.

• Config file is parsed, not sourced. load_config no longer runs
  . "$CONFIG_FILE"; a line parser accepts only allowlisted
  DPS_="" lines and ignores everything else, removing a
  code-execution path.
• Config writes escape embedded " and \ in every value (notably the
  free-text DPS_ORG badge) so a quote can no longer break parsing or
  inject shell. dps config now also persists DPS_HISTORY.
• Add dps theme <name> (default|mono|vivid): changes only DPS_THEME,
  preserves every other key, prints confirmation plus a live preview.
  Wired into cli.js FORWARD so npx devpilot-studio theme works too.
• Extract the shared settings.json validate/backup/merge logic into
  scripts/lib/wire-statusline.sh; install.sh and scripts/setup.sh now
  source it instead of each reimplementing it. No visible behavior
  change to either script.
• Remove duplicate command files commands/dps-{configure,demo,setup,
  uninstall}.md (byte-for-byte copies of the unprefixed versions);
  update the CI required-file list.
• Docs: the plugin Setup hook only fires on claude --init /
  --maintenance, not on /plugin install; the normal flow is to run
  /devpilot-studio:setup once by hand. Drop the stale "Legacy
  Fallback Support" section describing a CCB_/CCBAR_ fallback that
  does not exist in the code.

Co-Authored-By: Claude Sonnet 5 noreply@anthropic.com