Install the four applications this desktop assumed you had

Helium was already declared. Podman Desktop is on Flathub, so it joins the
flatpak list beside the podman it fronts.

RustDesk was the interesting one. panama-doctor has checked `rustdesk.service`
for as long as it has existed, and autostart.lua works around the tray that
service spawns -- so RustDesk was already part of this desktop, installed by
nothing. The flatpak cannot register a root-owned system service, so unattended
access needs the RPM.

Claude Code has no RPM and no flatpak either, so it takes the official installer
and keeps itself updated afterwards.

Neither pins a version. sunhat pinned upscayl 2.11.5, LACT 0.5.4 and a fedora-40
RPM, and every one of those was a 404 within a release cycle; the RustDesk URL is
resolved from whatever the latest release happens to be. Both are skipped when
already present, and a failure is logged and stepped over rather than aborting a
stage that has already installed the desktop.

That leaves three exceptions to the dnf-or-flatpak rule, all named in one place
with a reason each. The dependency contract now knows they are installed out of
band, so probing for them with `command -v` is not read as an undeclared
dependency -- narrowly, per command, so a genuine omission still fails.

Claude-Session: https://claude.ai/code/session_01Q84axqUE5inJhf5Jz9CFy1

setup/packages/flatpak-packages

@@ -5,3 +5,5 @@ app.bluebubbles.BlueBubbles
 org.mozilla.thunderbird_esr
 io.missioncenter.MissionCenter
 io.mpv.Mpv
+# A GUI over the podman that development-packages installs.
+io.podman_desktop.PodmanDesktop

setup/scripts/install-packages

@@ -98,12 +98,56 @@ else
 	log "Package list was not in specified path: $HYPR_FILE"
 fi
 
-# --- Install Bun ---
+# --- Applications no repository packages -------------------------------------
+#
+# Everything else Panama installs comes from dnf or Flathub. These three do not
+# exist in either, so each is an explicit exception with a reason, and each is
+# skipped when already present so a re-run costs nothing.
+#
+# None of them pins a version. sunhat pinned URLs -- upscayl 2.11.5, LACT 0.5.4,
+# a fedora-40 RPM -- and every one of them was a 404 within a release cycle. An
+# installer that resolves "latest" keeps working; one that names a version rots.
+#
+# A failure here is logged and stepped over rather than aborting: this stage has
+# already installed the desktop by this point, and an unreachable third-party
+# host should not cost you that.
+
+# Bun: the JavaScript runtime and package manager. No RPM, no flatpak.
 if [[ -x "$HOME/.bun/bin/bun" ]]; then
   log "Bun already installed at \"$HOME/.bun/bin/bun\""
 else
   log "Installing Bun via curl..."
-  curl -fsSL https://bun.sh/install | bash > /dev/null 2>&1
+  curl -fsSL https://bun.sh/install | bash > /dev/null 2>&1 || log "Bun install failed; skipping"
+fi
+
+# Claude Code: Anthropic's CLI. The official installer keeps itself updated
+# afterwards, so this runs once and then never needs to again.
+if command -v claude >/dev/null 2>&1; then
+  log "Claude Code already installed at \"$(command -v claude)\""
+else
+  log "Installing Claude Code via the official installer..."
+  curl -fsSL https://claude.ai/install.sh | bash > /dev/null 2>&1 || log "Claude Code install failed; skipping"
+fi
+
+# RustDesk: remote desktop. The flatpak cannot register the root-owned system
+# service that unattended access needs -- see panama-doctor's rustdesk check --
+# so this takes the RPM. The download URL is resolved from the latest release
+# rather than written down, so it does not go stale.
+if rpm -q rustdesk >/dev/null 2>&1; then
+  log "RustDesk already installed"
+else
+  log "Resolving the latest RustDesk release..."
+  rustdesk_url="$(curl -fsSL https://api.github.com/repos/rustdesk/rustdesk/releases/latest 2>/dev/null \
+    | jq -r '.assets[].browser_download_url | select(test("x86_64\\.rpm$")) | select(test("suse") | not)' \
+    | head -1)"
+  if [[ -n "$rustdesk_url" ]]; then
+    log "Installing RustDesk from $rustdesk_url"
+    # The RPM ships rustdesk.service already enabled, which is what provides
+    # unattended access; Panama deliberately does not start it a second time.
+    sudo dnf install -y "$rustdesk_url" > /dev/null || log "RustDesk install failed; skipping"
+  else
+    log "Could not resolve a RustDesk release; skipping"
+  fi
 fi
 
 # --- Install Flatpak Packages ---