Improve Tugboat preview setup: fix permissions warning, extract setup script, demo Domain Config

Problem/Motivation

The current Tugboat configuration has a few issues:

• Every preview visit triggers a "rebuild permissions" warning because node_access_rebuild() is not called after enabling Domain Access.
• The setup logic (module install, domain/alias creation, config) is inline in config.yml, making it hard to read and maintain.
• Seven separate drush pm:enable calls could be a single operation.
• The Domain Config feature is not demonstrated — there is no visible per-domain configuration override.

Proposed resolution

• Move all Drupal setup logic to a dedicated .tugboat/setup.php script, called from config.yml via drush php:script. The YAML file keeps only system-level operations (composer, Drupal install, file permissions, trusted hosts).
• Call node_access_rebuild() at the end of the setup script to eliminate the permissions warning.
• Use a single module_installer->install() call for all modules.
• Add a Domain Config override that sets a different Olivero primary color (#a30f0f, red) on the prefixed domain, giving reviewers a visible demonstration of per-domain configuration.

Remaining tasks

Review and test the Tugboat preview.