Install the four applications this desktop assumed you had

Helium was already declared. Podman Desktop is on Flathub, so it joins the
flatpak list beside the podman it fronts.

RustDesk was the interesting one. panama-doctor has checked `rustdesk.service`
for as long as it has existed, and autostart.lua works around the tray that
service spawns -- so RustDesk was already part of this desktop, installed by
nothing. The flatpak cannot register a root-owned system service, so unattended
access needs the RPM.

Claude Code has no RPM and no flatpak either, so it takes the official installer
and keeps itself updated afterwards.

Neither pins a version. sunhat pinned upscayl 2.11.5, LACT 0.5.4 and a fedora-40
RPM, and every one of those was a 404 within a release cycle; the RustDesk URL is
resolved from whatever the latest release happens to be. Both are skipped when
already present, and a failure is logged and stepped over rather than aborting a
stage that has already installed the desktop.

That leaves three exceptions to the dnf-or-flatpak rule, all named in one place
with a reason each. The dependency contract now knows they are installed out of
band, so probing for them with `command -v` is not read as an undeclared
dependency -- narrowly, per command, so a genuine omission still fails.

Claude-Session: https://claude.ai/code/session_01Q84axqUE5inJhf5Jz9CFy1

tests/quickshell/declared-dependencies-contract.sh

@@ -36,6 +36,17 @@ BASELINE='^(sh|bash|cat|cut|sed|awk|gawk|grep|egrep|head|tail|sort|uniq|tr|wc|fi
 
 SESSION='^(systemctl|busctl|journalctl|loginctl|hostnamectl|localectl|systemd-inhibit|systemd-run|udevadm|gsettings|dconf|dbus-send|dbus-monitor|hyprctl|qs|quickshell|gnf|panama|wl-copy|wl-paste)$'
 
+# Installed by install-packages itself, because no repository carries them.
+# They are deliberately absent from the package lists, and install-packages
+# probes for them with `command -v` precisely because they arrive out of band --
+# so that probe must not be read as an undeclared dependency. Anything added
+# here needs a matching install block and a stated reason for the exception.
+SELF_INSTALLED='^(bun|claude)$'
+
+# jq programs are quoted arguments, but the scanner is line-based and cannot
+# tell a filter from a command. `not` is a jq builtin appearing inside one.
+JQ_BUILTINS='^(not|empty|error|env|input|inputs)$'
+
 declared="$(cat "$repo_dir"/setup/packages/* 2>/dev/null | sed 's/#.*//' | tr -d ' ' | grep -v '^$' | sort -u)"
 [[ -n "$declared" ]] || fail 'no package lists found'
 
@@ -85,6 +96,8 @@ while read -r script; do
         [[ "$cmd" =~ $SHELL_WORDS ]] && continue
         [[ "$cmd" =~ $BASELINE ]] && continue
         [[ "$cmd" =~ $SESSION ]] && continue
+        [[ "$cmd" =~ $SELF_INSTALLED ]] && continue
+        [[ "$cmd" =~ $JQ_BUILTINS ]] && continue
 
         pkg="$(package_for "$cmd")"
         grep -qx "$pkg" <<<"$declared" && continue