fix: test local working tree in quickstart test (#938) (#978)

Closes #938.

## Problem

`scripts/test-hugo-quickstart.ts` installed the theme via `git submodule
add` from the **published** remote. As a result, CI (which checks out
the PR) and the pre-push hook always tested the published theme and
never the local code under test — a broken change could pass.

## Fix (Solution 3 from the issue, generalized)

The test now installs the **local working tree** as the theme by
default, using `git ls-files --cached --others --exclude-standard` so it
includes committed *and* uncommitted/untracked changes while skipping
ignored paths (`node_modules`, `public`, generated resources). A non-git
`--theme-path` falls back to a filtered recursive copy. The documented
published-submodule flow stays available behind `--use-submodule`.

- **Script:** new `--theme-path=<dir>` and `--use-submodule` flags;
defaults to local mode. Theme install is split out of the linear step
list into a dedicated `installTheme`, and the step loop is factored into
a `runSteps` helper.
- **CI** (`.github/workflows/quickstart.yml`): local mode runs on every
push/PR; submodule mode runs post-merge on `main`/`master` so the
published install path is still verified without testing stale code on
PRs.
- **package.json:** added `test:quickstart:submodule`.

## Verification

- Local mode: **PASS**.
- Negative test: a deliberate template break in `layouts/baseof.html`
now makes the test **fail** (exit 1) — the old remote-cloning version
passed it. Reverted after.
- `--use-submodule` mode: **PASS**.
- `biome check` clean; `tsc` reports no new errors.