Split login and interactive shell behavior behind unmanaged local hooks

## Parent

Parent: #1

## What to build

Split login-only and interactive-only shell behavior into managed entrypoints that preserve host-local/vendor snippets through unmanaged hooks.

This slice should keep login/session behavior out of universal zsh startup and keep prompts, completions, aliases, keybindings, and full interactive mise activation in the interactive shell layer. Vendor integrations such as Kiro or OrbStack should be preserved through optional local hooks rather than committed generated snippets.

## Acceptance criteria

- [ ] Login-shell behavior is managed separately from universal zsh startup and interactive shell startup.
- [ ] Interactive-only behavior is managed separately and can own prompt/completion/alias/keybinding setup and full interactive mise activation.
- [ ] Optional unmanaged local pre/post hooks are supported for login/session snippets.
- [ ] Missing local hook files do not fail shell startup.
- [ ] Vendor-generated snippets are not committed into managed shell files.
- [ ] Scripts and non-interactive agent commands do not need to source interactive shell configuration to find portable tools.
- [ ] Shell validation demonstrates the expected distinction between non-interactive, login, and interactive behavior.
- [ ] No managed shell file loads ambient secrets by default.

## Blocked by

- #4