Fix: Re-run verified installer inputs

install

@@ -22,7 +22,7 @@
 #   * setup-identity and install-hardware are dropped. They exist only to
 #     consume interview answers -- git identity, NVIDIA, Secure Boot, firmware
 #     -- and every one of those is a first-run decision.
-#   * install-packages runs only when the package lists actually changed.
+#   * install-packages runs only when its tracked installation inputs changed.
 #   * Migrations always run rather than baseline. See the migrations block.
 #
 # Everything else is shared on purpose: the sudo keepalive, the per-stage
@@ -64,12 +64,15 @@ done
 
 source "$PANAMA_PATH/bin/ascii"
 
-# ── Have the package lists changed? ──────────────────────────────────────────
+# ── Have the installation inputs changed? ───────────────────────────────────
 #
 # install-packages is the slow stage -- a dnf metadata refresh, a Flathub
 # round-trip, and a transaction that resolves to "nothing to do" almost every
-# time. On an upgrade it is worth running only when the lists it reads actually
-# changed, so this hashes them and remembers the result.
+# time. On an upgrade it is worth running only when its package lists or
+# reviewed installer trust inputs changed, so this hashes them and remembers
+# the result. The framed, sorted stream includes top-level package files, the
+# package-stage adapter, the provenance helper, and regular provenance files;
+# both relative paths and bytes are part of the state.
 #
 # A content hash rather than a git range, because Panama is developed in place:
 # a package added to a list and not yet committed must still install. A range
@@ -86,8 +89,21 @@ STATE_DIR="${XDG_STATE_HOME:-$HOME/.local/state}/panama"
 PACKAGES_HASH="$STATE_DIR/packages-hash"
 
 hash_packages() {
-  find "$PANAMA_PATH/setup/packages" -maxdepth 1 -type f -exec sha256sum {} + \
-    | sort | sha256sum | cut -d' ' -f1
+  local file relative size
+
+  {
+    find "$PANAMA_PATH/setup/packages" -maxdepth 1 -type f -print0
+    printf '%s\0' \
+      "$PANAMA_PATH/setup/scripts/install-packages" \
+      "$PANAMA_PATH/setup/lib/artifact-provenance"
+    find "$PANAMA_PATH/setup/provenance" -type f -print0
+  } | LC_ALL=C sort -z | while IFS= read -r -d '' file; do
+    relative="${file#"$PANAMA_PATH"/}"
+    size="$(wc -c <"$file")"
+    printf '%s\0%s\0' "$relative" "$size"
+    cat -- "$file"
+    printf '\0'
+  done | sha256sum | cut -d' ' -f1
 }
 
 packages_needed() {