Closes #1117

Summary

• Adds dump_answers(sel) -> dict and write_answers(sel, path) to src/hal0/install/answers.py — the serializer counterpart to the load_answers loader merged in installer-setup: answer-file core loader (hal0 setup --answers) #1115/installer-setup: answer-file core loader (hal0 setup --answers) #1119, closing the round trip described in handoffs/hal0-setup-answers-spec-2026-07-05.md §2/§3.
• Adds hal0 setup --emit-answers PATH to src/hal0/cli/setup_command.py: resolves a Selections (via --answers/load_answers if given, else build_auto_selections(...) for --auto/default), writes it to a hal0-setup.yaml (version: 1), prints the path, and returns before any apply/slot-write/sentinel step. Added as a single early-return branch alongside the existing options, to minimize conflicts with the sibling --plan PR (installer-setup: hal0 setup --plan dry-run preview #1116) touching the same callback.
• Security (spec §8): never inlines a Hugging Face token. Emits huggingface: {token_env: HF_TOKEN} only.
• Slot capabilities the answer-file schema doesn't yet accept (embed/rerank/stt/tts/vision — load_answers only accepts chat/coder today) are warned-and-skipped in dump_answers rather than emitting a file load_answers would reject.

Acceptance criteria

• dump_answers(sel) -> dict produces a version: 1 mapping matching the exact key layout load_answers reads (model_store.path, slots[], apps.*.enabled, gen.mode/gen.capabilities, npu.opt_in).
• write_answers(sel, path) yaml.safe_dumps the doc with a leading header comment noting the file was resolved against detected hardware.
• --emit-answers added to the setup(...) typer callback; writes the file and returns before run_install/apply_setup is ever reached.
• Works from --auto, from --answers, and from the bare default (no TTY interactive block).
• Round-trip tests: dump_answers → yaml.safe_dump → load_answers reproduces an equivalent Selections (storage_dir, slot capabilities/models/device/profile, extensions, npu_opt_in, comfyui_defaults), both for a hand-built Selections and for build_auto_selections(...) on a fake hardware profile.
• Emitted YAML never contains a real token value — only token_env: HF_TOKEN.
• CLI test confirms --emit-answers makes no slot/sentinel writes (run_install/apply_setup monkeypatched to raise; not called).

Test plan

uv run ruff format src tests               # 1 file reformatted (new test file), rest unchanged
uv run ruff check src tests                # All checks passed!
uv run ruff format --check src tests       # 634 files already formatted
uv run pytest tests/install/test_emit_answers.py tests/install/test_answers.py tests/cli/ -q
  # 11 new + 272 existing passed; 3 pre-existing hermes-venv failures unrelated to this change
uv run pytest tests/ -q --ignore=tests/e2e
  # 4625 passed, 14 failed, 1 error, 8 skipped — all pre-existing (hermes venv/wrapper,
  # comfyui phase4, proxmox host detection, container spec, config-url-proxy,
  # models-preview, settings-store, openwebui prewire); none touch install/answers.py,
  # orchestrate.py, or setup_command.py

🤖 Generated with Claude Code