Ask everything first, then run without needing anybody

sunhat's failure mode was a question twenty minutes into a run. Walking away
from an install meant coming back to a prompt that had been waiting an hour.

So the questions move to the front. A new interview stage asks what Panama needs
to be told -- hostname, git identity, whether to sign in to GitHub, whether to
make an SSH key -- shows the answers back, and asks once to proceed. After that
nothing asks again. gum is bootstrapped before it runs, because the interview is
built on gum and gum arrives with a stage that has not run yet.

Answers reach the stages through a mktemp file that install sources and the
existing trap deletes, since a child process cannot export into its siblings.
They are not remembered between runs: there is no state file to go stale, and
one of the answers is an email address.

The interview asks only what a stage in this repository actually consumes.
Extras, hardware and debloat questions arrive with the stages that act on them
-- a prompt whose answer nothing reads is a control that lies. The new contract
pins that in both directions, and four deliberate mutations confirmed it catches
a question nobody reads, a stage reading something nobody asks, an answers file
left on disk, and a declined interview that fails to stop the run.

The run now ends with panama-doctor, because a failed-stage count says nothing
about a service that did not start. It never changes the exit code: on a fresh
machine, unconfigured is the honest answer, not a failure.

espanso and oh-my-posh stop being exceptions -- Terra packages espanso-wayland
and Fedora packages oh-my-posh, so the curl installer is gone. bun is now the
only remaining one.

Claude-Session: https://claude.ai/code/session_01Q84axqUE5inJhf5Jz9CFy1

setup/scripts/setup-identity

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+
+# Who this machine belongs to: git identity, GitHub, and an SSH key.
+#
+# Runs last, because gh and git-all arrive with install-packages. Everything here
+# is driven by answers the interview collected before the run started, so nothing
+# in this stage blocks waiting for input -- except `gh auth login`, which is an
+# interactive browser flow by nature and only runs when it was asked for.
+#
+# Every value is optional. A blank answer means "keep whatever is already set",
+# which is what makes this safe to re-run: the interview's prompts start empty
+# every time by design, and an empty answer must never erase a correct name.
+
+set -uo pipefail
+
+log() { echo -e "\033[1;34m[INFO]\033[0m $*"; }
+
+git_name="${PANAMA_GIT_NAME:-}"
+git_email="${PANAMA_GIT_EMAIL:-}"
+git_editor="${PANAMA_GIT_EDITOR:-}"
+
+if [[ -n "$git_name" ]]; then
+    git config --global user.name "$git_name"
+    log "git user.name set to $git_name"
+fi
+if [[ -n "$git_email" ]]; then
+    git config --global user.email "$git_email"
+    log "git user.email set to $git_email"
+fi
+if [[ -n "$git_editor" ]]; then
+    git config --global core.editor "$git_editor"
+    log "git core.editor set to $git_editor"
+fi
+
+# Aliases and pull behaviour, carried over from sunhat. Setting these is
+# idempotent, so they are applied unconditionally rather than asked about.
+git config --global alias.co checkout
+git config --global alias.br branch
+git config --global alias.ci commit
+git config --global alias.st status
+git config --global pull.rebase true
+log "git aliases and pull.rebase applied"
+
+if [[ "${PANAMA_GH_LOGIN:-no}" == yes ]]; then
+    if command -v gh >/dev/null 2>&1; then
+        log "Signing in to GitHub"
+        gh auth login || log "GitHub sign-in did not complete; run 'gh auth login' later"
+    else
+        log "gh is not installed; skipping GitHub sign-in"
+    fi
+fi
+
+if [[ "${PANAMA_SSH_KEY:-no}" == yes ]]; then
+    key="$HOME/.ssh/id_ed25519"
+    if [[ -e "$key" ]]; then
+        log "An SSH key already exists at $key; leaving it alone"
+    else
+        mkdir -p "$HOME/.ssh"
+        chmod 700 "$HOME/.ssh"
+        # No passphrase prompt: this stage runs inside an install that was
+        # promised to need no attention. A key can be given a passphrase later
+        # with ssh-keygen -p.
+        ssh-keygen -t ed25519 -N "" -C "${git_email:-$USER@$(hostname)}" -f "$key" >/dev/null
+        log "SSH key generated at $key"
+        log "Public key: $(cat "$key.pub")"
+    fi
+fi