Install the driver, enrol the key, and still never ask twice

Phase 3 of the fresh-install spec: the parts of a run that depend on what the
machine actually is. NVIDIA, Secure Boot, Fedora's preinstalled extras, firmware.

Two of these looked like they would force a compromise, and neither did.

sunhat opened an editor in the middle of its run so grub could be hand-corrected,
and that single step is why walking away from an install did not work. The step
existed to delete duplicated kernel arguments -- and grubby replaces an argument
that already exists rather than appending a second copy, so the duplicates cannot
accumulate and there is nothing to correct. The editor was load-bearing for a
problem that a different tool does not have.

MOK enrolment needs a password now and the same password at the next boot's blue
screen, which reads like a prompt that has to happen mid-run. mokutil has
--generate-hash and --hash-file for exactly this: the interview asks, hashes it
on the spot, and records only the hash. The plaintext never reaches the answers
file, the environment, or a command line, and the stage runs without asking.

The stage runs last rather than fourth as the spec's table had it. The constraint
was always "late" and fourth of eight is not late: enrolment arms a prompt for the
next boot and firmware may want a reboot, so a machine that reboots out of this
stage should already be completely configured.

Every question names what was found -- the card, the packages actually installed
-- and is not asked at all on a machine it would do nothing to. sunhat's debloat
list no longer describes Fedora 44: totem became showtime and LibreOffice is not
preinstalled, so the list is curated and a package that is not installed is never
passed to dnf, which is what lets it outlive a release.

This stage cannot be verified by running it. It installs a proprietary driver and
queues a Secure Boot enrolment, and this machine is an AMD desktop. So every
privileged command is stood in on PATH and the contract asserts which answer led
to which call: that no answers means no commands, that a failed driver install is
not followed by arguments and services for a driver that is not there, that the
hash reaches mokutil through a file and never a command line, and that removal is
offered only for packages that are installed. The contract was checked by breaking
the stage three ways and confirming it caught each. It does not verify that
akmod-nvidia builds, and says so where a reader would otherwise assume it did.

The README's stage table listed three of seven stages; the interview and identity
work never reached it. Corrected rather than extended, since a table that lists
three of seven is worse than one that lists none. The Desktops section still
describes a GNOME session nothing installs -- that is phase 5.

Claude-Session: https://claude.ai/code/session_01NvgBuSWB5sE43yWmg21ozj

install

@@ -53,8 +53,11 @@ gsettings set org.gnome.desktop.session idle-delay 0 2>/dev/null || true
 # Explicit order, not glob order: change-settings runs `vicinae theme set`,
 # which needs both vicinae itself (installed by install-packages) and the
 # theme files it selects among (symlinked into place by link-dotfiles);
-# setup-identity needs the gh and git-all that install-packages provides. New
-# scripts must be added here explicitly, or they will not run at all.
+# setup-identity needs the gh and git-all that install-packages provides; and
+# install-hardware is last because MOK enrolment arms a prompt consumed at the
+# next boot and a firmware update may ask for a reboot -- a machine that reboots
+# out of the final stage has already been completely configured. New scripts
+# must be added here explicitly, or they will not run at all.
 
 # The interview is not in that list, because it is the one stage whose output the
 # installer reads back -- and because declining it must stop everything rather
@@ -73,7 +76,8 @@ fi
 # shellcheck source=/dev/null
 source "$PANAMA_ANSWERS"
 export PANAMA_HOSTNAME PANAMA_GIT_NAME PANAMA_GIT_EMAIL PANAMA_GIT_EDITOR \
-       PANAMA_GH_LOGIN PANAMA_SSH_KEY
+       PANAMA_GH_LOGIN PANAMA_SSH_KEY PANAMA_NVIDIA PANAMA_MOK_HASH \
+       PANAMA_DEBLOAT PANAMA_FIRMWARE
 
 # Applied here rather than in a stage, and applied early: it needs sudo, and
 # sudo is warm right now. At the end of a long unattended run the timestamp has
@@ -84,7 +88,7 @@ if [[ -n "${PANAMA_HOSTNAME:-}" ]]; then
   echo "Hostname set to: $(hostname)"
 fi
 
-STAGES=(install-packages link-dotfiles change-settings link-vicinae-scripts setup-identity)
+STAGES=(install-packages link-dotfiles change-settings link-vicinae-scripts setup-identity install-hardware)
 failed=()
 for stage in "${STAGES[@]}"; do
   script="$PANAMA_PATH/setup/scripts/$stage"