Fix: Re-run verified installer inputs

tests/setup/update-command-contract

@@ -46,11 +46,15 @@ build_fixture() {
     local root="$1" packages_rc="${2:-0}" trust_rc="${3:-0}"
     rm -rf "$root"
     mkdir -p "$root/bin" "$root/setup/scripts" "$root/setup/packages" \
+             "$root/setup/lib" "$root/setup/provenance/keys" \
              "$root/config/dot/quickshell/scripts"
 
     cp "$installer" "$root/install"
     : >"$root/bin/ascii"
-    printf 'base-package\n' >"$root/setup/packages/base"
+    printf 'base-package\n' >"$root/setup/packages/core-packages"
+    printf 'artifact provenance\n' >"$root/setup/lib/artifact-provenance"
+    printf 'reviewed installer inputs\n' >"$root/setup/provenance/installers.conf"
+    printf 'reviewed key\n' >"$root/setup/provenance/keys/fixture.asc"
 
     local stage
     for stage in "${STAGE_NAMES[@]}"; do
@@ -210,7 +214,7 @@ grep -qx 'install-packages' <<<"$ran_forced" \
     || note '--packages did not force install-packages to run'
 
 # A changed list brings the stage back.
-printf 'another-package\n' >>"$tmp/a/setup/packages/base"
+printf 'another-package\n' >>"$tmp/a/setup/packages/core-packages"
 install_status=0
 ran_changed="$(run_install "$tmp/a" --upgrade)" || install_status=$?
 [[ "$install_status" -eq 0 ]] \
@@ -218,6 +222,24 @@ ran_changed="$(run_install "$tmp/a" --upgrade)" || install_status=$?
 grep -qx 'install-packages' <<<"$ran_changed" \
     || note 'a changed package list did not bring install-packages back'
 
+# The package stage consumes more than package lists. Each reviewed input must
+# independently invalidate a recorded package state so an upgrade cannot keep
+# using a stale trust or installer policy.
+for state_input in \
+    'setup/scripts/install-packages installer adapter' \
+    'setup/lib/artifact-provenance provenance helper' \
+    'setup/provenance/installers.conf installer provenance' \
+    'setup/provenance/keys/fixture.asc provenance key'; do
+    read -r relative label <<<"$state_input"
+    printf 'changed %s\n' "$label" >>"$tmp/a/$relative"
+    install_status=0
+    ran_input_changed="$(run_install "$tmp/a" --upgrade)" || install_status=$?
+    [[ "$install_status" -eq 0 ]] \
+        || note "install --upgrade failed after a $label change with status $install_status"
+    grep -qx 'install-packages' <<<"$ran_input_changed" \
+        || note "a changed $label did not bring install-packages back"
+done
+
 # A failing stage must not record the hash, or the failure is hidden forever.
 build_fixture "$tmp/c" 1
 install_status=0