Install what the default-application roles are curated to

Seeding is deliberately conservative: a role whose preferred applications
are all missing is left alone rather than forced. That is right, and it
is also silent -- so a curated handler nobody installs presents as the
machine quietly going back to deciding defaults by installation order,
which is the problem seeding exists to fix. None of Loupe, Papers,
Decibels, Nautilus, mpv or sushi was declared anywhere.

Preview works, on org.gnome.NautilusPreviewer2 rather than the interface
its bus name suggests, but it opened tiled -- shoving the file manager
aside for something meant to be an overlay -- so it gets a float and
center rule sized to leave the file underneath visible.

xdg-utils and desktop-file-utils were undeclared too; seeding from
link-dotfiles started calling them, and the dependency contract said so.

Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L

tests/quickshell/default-apps-family-contract.sh

@@ -92,6 +92,53 @@ extra="$(comm -13 <(printf '%s\n' "$helper_roles") <(printf '%s\n' "$page_roles"
 [[ -z "${missing// }" ]] || fail "the helper can set these roles but the settings page never offers them: $missing"
 [[ -z "${extra// }" ]] || fail "the settings page offers roles the helper cannot set: $extra"
 
+# Every application a role is curated to must be installed by Panama's own
+# package lists.
+#
+# Seeding is deliberately conservative: a role whose preferred applications are
+# all missing is left alone rather than forced. That is the right behavior and
+# it is also silent -- so a curated handler nobody installs presents as the
+# machine quietly going back to deciding defaults by installation order, which
+# is the whole problem this was built to fix.
+#
+# The package name for each handler is spelled out here because a desktop id
+# does not carry one; rpm and flatpak name the same application differently and
+# neither name is derivable from the other.
+declare -A HANDLER_PACKAGE=(
+    [org.gnome.Loupe.desktop]=loupe
+    [org.gnome.Papers.desktop]=papers
+    [org.gnome.Decibels.desktop]=decibels
+    [org.gnome.Nautilus.desktop]=nautilus
+    [io.mpv.Mpv.desktop]=io.mpv.Mpv
+)
+
+declared="$(cat "$repo_dir"/setup/packages/* 2>/dev/null | sed 's/#.*//' | tr -d ' ' | grep -v '^$' | sort -u)"
+[[ -n "$declared" ]] || fail 'no package lists found'
+
+preferred="$(python3 - "$helper" <<'PREFERRED'
+import ast, re, sys
+source = open(sys.argv[1]).read()
+table = ast.literal_eval(re.search(r"PREFERRED_HANDLERS = (\{.*?\n\})", source, re.S).group(1))
+for role, candidates in table.items():
+    # Only the first choice has to be installable: the rest are fallbacks for
+    # machines that happen to have something else, and demanding all of them be
+    # declared would mean installing three image viewers.
+    print(role + "\t" + candidates[0])
+PREFERRED
+)" || fail 'could not read PREFERRED_HANDLERS from the helper'
+
+while IFS=$'\t' read -r role handler; do
+    [[ -n "$role" ]] || continue
+    # Entries this repository ships itself are installed by link-dotfiles, not
+    # by a package manager.
+    [[ -r "$repo_dir/config/local/share/applications/$handler" ]] && continue
+    package="${HANDLER_PACKAGE[$handler]:-}"
+    [[ -n "$package" ]] \
+        || fail "the \"$role\" role prefers $handler, which this contract has no package name for -- add it to HANDLER_PACKAGE"
+    grep -qx "$package" <<<"$declared" \
+        || fail "the \"$role\" role prefers $handler but nothing declares \"$package\", so a fresh machine seeds nothing for it"
+done <<<"$preferred"
+
 # The editor Panama ships must launch in Panama's terminal. The stock
 # nvim.desktop sets Terminal=true, which hands the launch to whatever the
 # system considers default -- not necessarily the terminal this desktop themes.