shadow's commonio_open() refuses to modify a user/group database whose
last line has no trailing newline, failing with a misleading
"cannot open /etc/passwd". Under 'set -e' this aborted the whole setup
at the fish step (and would later break docker's groupadd/usermod too).
- add ensure_db_trailing_newlines() to normalize /etc/passwd, /etc/group
and /etc/shadow before any user/group modification
- switch default shell via 'usermod -s' with a 'chsh' fallback, warning
instead of aborting the script on failure