Ask everything first, then run without needing anybody

sunhat's failure mode was a question twenty minutes into a run. Walking away
from an install meant coming back to a prompt that had been waiting an hour.

So the questions move to the front. A new interview stage asks what Panama needs
to be told -- hostname, git identity, whether to sign in to GitHub, whether to
make an SSH key -- shows the answers back, and asks once to proceed. After that
nothing asks again. gum is bootstrapped before it runs, because the interview is
built on gum and gum arrives with a stage that has not run yet.

Answers reach the stages through a mktemp file that install sources and the
existing trap deletes, since a child process cannot export into its siblings.
They are not remembered between runs: there is no state file to go stale, and
one of the answers is an email address.

The interview asks only what a stage in this repository actually consumes.
Extras, hardware and debloat questions arrive with the stages that act on them
-- a prompt whose answer nothing reads is a control that lies. The new contract
pins that in both directions, and four deliberate mutations confirmed it catches
a question nobody reads, a stage reading something nobody asks, an answers file
left on disk, and a declined interview that fails to stop the run.

The run now ends with panama-doctor, because a failed-stage count says nothing
about a service that did not start. It never changes the exit code: on a fresh
machine, unconfigured is the honest answer, not a failure.

espanso and oh-my-posh stop being exceptions -- Terra packages espanso-wayland
and Fedora packages oh-my-posh, so the curl installer is gone. bun is now the
only remaining one.

Claude-Session: https://claude.ai/code/session_01Q84axqUE5inJhf5Jz9CFy1

setup/packages/desktop-packages

@@ -3,6 +3,9 @@ akmods
 alsa-plugins-pulseaudio
 cascadiamono-nerd-fonts
 decibels
+# The Wayland build specifically; the x11 one cannot inject into this session.
+# Its config is linked by link-dotfiles.
+espanso-wayland
 desktop-file-utils
 dnf-plugins-core
 ffmpeg

setup/packages/initial-packages

@@ -18,6 +18,10 @@ kitty
 ksshaskpass
 libselinux-utils
 neovim
+# config/bash/shell initialises the prompt with this.
+oh-my-posh
+# ssh-keygen, which setup-identity uses to create a key on request.
+openssh
 openssl
 pciutils
 python3-dnf