Make ./install something you could hand a stranger

The audit's third tier: everything between this installer and a fresh machine
it has never met.

The one path that could cost a person their display: the interview probes
Secure Boot with mokutil, which install-packages had not installed yet, so on
a minimal base the MOK question silently never fired -- and install-hardware
still installed akmod-nvidia and blacklisted nouveau, arming a reboot into an
unloadable driver with its fallback disabled. The probe tools (pciutils,
mokutil, fwupd) now bootstrap beside gum, and install-hardware re-checks
Secure Boot for itself and refuses the driver rather than the display.

Secrets leave the checkout: the personal environment moves to
~/.config/panama/env at mode 600 by migration, and .bashrc sources it with a
permission check that quietly re-tightens drift. change-settings no longer
overwrites /etc/dnf/dnf.conf -- two performance keys are set additively, the
defaultyes=True that made every `dnf remove` treat Enter as yes is gone, and
a migration strips it from machines that already received it.

Package installation survives the world changing: the initial and desktop
lists run with --skip-unavailable and a report_missing pass that names what
was skipped (resolved through --whatprovides, so capability names like awk
do not cry wolf); the openh264, appstream and core-group extras go through
soft; RustDesk resolves its RPM for the machine's own architecture; and the
Claude Desktop repository script is fetched to a kept file and run, never
piped from the network into root.

The hardware predicates stop guessing: a wireless mouse's scope=Device
battery no longer turns a tower into a laptop, USB-PD-only machines read
their power state from the battery's own status instead of being permanently
"on AC", the lid falls back to logind's LidClosed where ACPI is silent, and
charge limits reach every pack of a two-battery machine in one authorization
-- with the reported percentage summed across packs.

And the parsers stop assuming this machine: snapper is read through
--machine-readable csv with named columns instead of a localized box-drawing
table, and reports whether snapshots are even possible so ext4 and
unconfigured-btrfs stop looking identical; fprintd is parsed under LC_ALL=C;
the hypridle drop-in resolves the binary it points at; the recorder's render
node became an "auto" token resolved at record time; update-grub writes the
config its firmware actually boots; the nvm prompt hook and the SSH tmux
takeover are guarded; hipblas and rocm-opencl move to an opt-in gpu-compute
category; and the two interactive python tools' libraries are declared.

Claude-Session: https://claude.ai/code/session_01Epx9ZC1gwm81K3jm9x9CKh

migrations/1787500624.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+
+# Remove defaultyes=True from /etc/dnf/dnf.conf on machines Panama configured.
+#
+# change-settings used to copy a whole dnf.conf over the machine's own, and
+# that file set defaultyes=True -- so every `dnf remove`, for every user,
+# treated a bare Enter as confirmation. The installer no longer ships the
+# file; this repairs the machines that already received it. Only the one
+# behavior key is touched: the performance keys it carried are harmless and
+# now applied additively by change-settings.
+
+set -euo pipefail
+
+conf=/etc/dnf/dnf.conf
+
+[[ -r "$conf" ]] || exit 0
+grep -q '^defaultyes=True$' "$conf" || exit 0
+
+PANAMA_PATH="${PANAMA_PATH:-$HOME/.local/share/Panama}"
+sudo_cmd=(sudo)
+if [[ -t 0 && -x "$PANAMA_PATH/bin/panama-sudo" ]]; then
+    sudo_cmd=(
+        "$PANAMA_PATH/bin/panama-sudo" --reason
+        "Removing defaultyes=True from dnf.conf, which made every dnf remove treat Enter as yes"
+        --
+    )
+fi
+
+"${sudo_cmd[@]}" sed -i '/^defaultyes=True$/d' "$conf"
+echo "Removed defaultyes=True from $conf; dnf prompts default to No again."

migrations/1787500660.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+
+# Move the personal environment file out of the checkout.
+#
+# config/bash/env holds API keys and tokens, and it lived inside the working
+# tree that agents, backup tools and `panama update`'s diff walk routinely --
+# world-readable by default, one careless `git add -f` away from a remote.
+# Its home is now ~/.config/panama/env, owner-only, which .bashrc sources
+# with a permission check. The repo path keeps working unmigrated (the glob
+# in .bashrc still sources it), so this move can safely run at any login.
+
+set -euo pipefail
+
+PANAMA_PATH="${PANAMA_PATH:-$HOME/.local/share/Panama}"
+old="$PANAMA_PATH/config/bash/env"
+new="${XDG_CONFIG_HOME:-$HOME/.config}/panama/env"
+
+[[ -f "$old" ]] || exit 0
+
+if [[ -f "$new" ]]; then
+    # Both exist: the person already started one at the new home. Refusing to
+    # merge secrets automatically is the safe answer; say what is where.
+    chmod 600 "$old" "$new"
+    echo "Both $old and $new exist; not merging them automatically."
+    echo "Move what you still need into $new and delete the old file."
+    exit 0
+fi
+
+mkdir -p "$(dirname "$new")"
+mv "$old" "$new"
+chmod 600 "$new"
+echo "Moved the personal environment to $new (owner-only)."