Fix: Re-run verified installer inputs

tests/setup/package-provenance-contract

@@ -128,6 +128,19 @@ if (( ${#unsafe_installers[@]} > 0 )); then
     fail 'replace each finding with a reviewed, verified installation path'
 fi
 
+# Re-running install-packages must be keyed to every reviewed trust input it
+# consumes. The update-command fixture proves each input changes the digest;
+# this public-boundary guard keeps any of those inputs from being silently
+# removed from the installer state definition.
+for state_input in \
+    'setup/packages' \
+    'setup/scripts/install-packages' \
+    'setup/lib/artifact-provenance' \
+    'setup/provenance'; do
+    grep -Fq "$state_input" "$repo_dir/install" \
+        || fail "packages hash does not name required state input: $state_input"
+done
+
 # This must be the only production file sourced by the contract.
 # shellcheck source=../../setup/lib/artifact-provenance
 source "$repo_dir/setup/lib/artifact-provenance"