Fix: Enforce effective repository trust preflight

tests/setup/update-command-contract

@@ -43,7 +43,7 @@ STAGE_NAMES=(install-packages link-dotfiles link-skills link-user change-setting
 # A PANAMA_PATH that looks enough like the real one for install to run, and
 # records what it was asked to do instead of doing it.
 build_fixture() {
-    local root="$1" packages_rc="${2:-0}"
+    local root="$1" packages_rc="${2:-0}" trust_rc="${3:-0}"
     rm -rf "$root"
     mkdir -p "$root/bin" "$root/setup/scripts" "$root/setup/packages" \
              "$root/config/dot/quickshell/scripts"
@@ -63,6 +63,10 @@ EOF
     # The one stage whose exit code the caller wants to control.
     cat >"$root/setup/scripts/install-packages" <<EOF
 #!/usr/bin/env bash
+if [[ "\${1:-}" == --trust-preflight ]]; then
+  printf 'trust-preflight\n' >>"\$PANAMA_RAN"
+  exit $trust_rc
+fi
 printf 'install-packages\n' >>"\$PANAMA_RAN"
 exit $packages_rc
 EOF
@@ -103,6 +107,14 @@ EOF
 #!/usr/bin/env bash
 exit 0
 EOF
+    cat >"$root/shim/dnf" <<'EOF'
+#!/usr/bin/env bash
+printf 'dnf-transaction\n' >>"$PANAMA_RAN"
+exit 0
+EOF
+    for prerequisite in gum lspci mokutil fwupdmgr; do
+        ln -s gsettings "$root/shim/$prerequisite"
+    done
     chmod +x "$root/shim"/*
 }
 
@@ -215,6 +227,44 @@ run_install "$tmp/c" --upgrade >/dev/null || install_status=$?
 if [[ -r "$tmp/c/state/panama/packages-hash" ]]; then
     note 'install-packages failed but its hash was recorded, so it will never be retried'
 fi
+grep -qx 'link-dotfiles' "$tmp/c/ran" \
+    || note 'an ordinary package-stage failure no longer allows later safe stages'
+
+# An invalid enabled Terra root is not an ordinary package failure. It must
+# stop before the installer's bootstrap DNF and before every stage.
+build_fixture "$tmp/terra-preflight-hard" 0 78
+install_status=0
+run_install "$tmp/terra-preflight-hard" >/dev/null || install_status=$?
+[[ "$install_status" -eq 78 ]] \
+    || note "initial Terra trust failure returned $install_status instead of 78"
+asserted_preflight="$(<"$tmp/terra-preflight-hard/ran")"
+[[ "$asserted_preflight" == trust-preflight ]] \
+    || note "initial Terra trust failure allowed later work: ${asserted_preflight//$'\n'/,}"
+
+# The trust verifier is itself mandatory. Losing its executable adapter must
+# fail closed before interview, bootstrap, or stage work.
+build_fixture "$tmp/terra-preflight-missing"
+rm "$tmp/terra-preflight-missing/setup/scripts/install-packages"
+install_status=0
+run_install "$tmp/terra-preflight-missing" >/dev/null || install_status=$?
+[[ "$install_status" -eq 78 ]] \
+    || note "missing Terra trust verifier returned $install_status instead of 78"
+[[ ! -s "$tmp/terra-preflight-missing/ran" ]] \
+    || note 'missing Terra trust verifier allowed later work'
+
+# The package stage repeats the preflight to close a configuration-change race.
+# Its hard status must also stop link stages and install-hardware immediately.
+build_fixture "$tmp/terra-stage-hard" 78 0
+install_status=0
+run_install "$tmp/terra-stage-hard" >/dev/null || install_status=$?
+[[ "$install_status" -eq 78 ]] \
+    || note "stage-time Terra trust failure returned $install_status instead of 78"
+grep -qx 'install-packages' "$tmp/terra-stage-hard/ran" \
+    || note 'stage-time Terra trust fixture never reached install-packages'
+for suppressed in link-dotfiles link-skills link-user change-settings install-hardware dnf-transaction; do
+    grep -qx "$suppressed" "$tmp/terra-stage-hard/ran" \
+        && note "stage-time Terra trust failure still ran $suppressed"
+done
 
 # A full install always runs the stage, whatever any recorded hash says.
 build_fixture "$tmp/d"