Fix: Enforce effective repository trust preflight

install

@@ -105,6 +105,23 @@ record_packages_hash() {
   hash_packages >"$PACKAGES_HASH"
 }
 
+# Repository trust is checked before the installer can reach its bootstrap DNF.
+# Status 78 is reserved for a trust-root failure and is propagated unchanged so
+# no later stage, especially install-hardware, can invoke DNF with that repo.
+TERRA_TRUST_FAILURE_STATUS=78
+trust_preflight="$PANAMA_PATH/setup/scripts/install-packages"
+if [[ ! -x "$trust_preflight" ]]; then
+  printf 'install: package repository trust preflight is unavailable\n' >&2
+  exit "$TERRA_TRUST_FAILURE_STATUS"
+fi
+if "$trust_preflight" --trust-preflight; then
+  :
+else
+  trust_status=$?
+  printf 'install: package repository trust preflight failed\n' >&2
+  exit "$trust_status"
+fi
+
 # ── The interview ────────────────────────────────────────────────────────────
 #
 # Everything Panama needs to be told is asked here, before a single package is
@@ -294,11 +311,18 @@ for stage in "${STAGES[@]}"; do
     echo "Run with --packages to install them anyway."
     continue
   fi
-  if ! "$script"; then
+  if "$script"; then
+    if [[ "$stage" == install-packages ]]; then
+      record_packages_hash
+    fi
+  else
+    stage_status=$?
+    if [[ "$stage" == install-packages && "$stage_status" -eq "$TERRA_TRUST_FAILURE_STATUS" ]]; then
+      printf '!!! %s stopped on an untrusted package repository\n' "$stage" >&2
+      exit "$stage_status"
+    fi
     failed+=("$stage")
     printf '!!! %s failed\n' "$stage" >&2
-  elif [[ "$stage" == install-packages ]]; then
-    record_packages_hash
   fi
 done