chsh is blocked on the corp dev VM (PAM-level restriction at user-
provisioning time). Drop the sudo chsh -s call from 20-zsh.sh and
append a guarded `exec zsh -l` block to ~/.bashrc instead — same UX
without needing infra escalation, also matches the legacy WSL setup
pattern in 02-wsl-terminal-setup.md.
The hand-off is guarded by `case $- in *i*)` so non-interactive bash
flows (scp, rsync, cron) are unaffected, and by a ZSH_VERSION absence
check to prevent re-exec loops.
Main doc and README table descriptions updated to match.