Pin Terra on a server that already has it, before its package update

tests/setup/desktop-first-contract

@@ -90,6 +90,15 @@ PY
 sed -n '/^if \[\[ "\$ROLE" == server \]\]; then/,/^fi/p' "$installer" | grep -q '^\s*exit 0' \
     || note 'the server branch does not exit before the desktop section'
 
+# A server pins a Terra it already has, but never installs one: the Terra call
+# in the server branch must sit behind the terra-release check.
+server_branch="$(sed -n '/^if \[\[ "\$ROLE" == server \]\]; then/,/^fi/p' "$installer")"
+if grep -q 'install_terra_repository' <<<"$server_branch"; then
+    awk '/rpm -q terra-release/ { guarded = 1 } /install_terra_repository/ && !guarded { bad = 1 }
+         END { exit bad }' <<<"$server_branch" \
+        || note 'the server branch can install Terra on a server that never had it'
+fi
+
 # ── Everything fragile is actually tolerated ────────────────────────────────
 #
 # Being below the desktop is only half of it. A bare `dnf swap` below the