Fix the install pipeline and an idle-lock startup race

The initial package list was quoted into a single bogus dnf argument
and every dnf error was discarded, so a fresh install silently skipped
most of it. Two package lists were never wired into the pipeline at
all, and change-settings ran before install-packages, so the vicinae
theme step was permanently skipped. Fixed the ordering, the quoting,
and stopped swallowing errors.

Separately, hypridle could start with its WAYLAND_DISPLAY condition
unmet if it raced the env-publish call, silently never starting --
and it's the only listener for the logind Lock signal. Made the start
wait on the environment synchronously. panama-idle also wrote its
generated config to a fixed temp path with no locking, so concurrent
applies could interleave into a corrupt file; switched to mktemp plus
an atomic mv.

Claude-Session: https://claude.ai/code/session_01E6TJUAh41HaP25MVHWkhRZ

install

@@ -49,10 +49,16 @@ gsettings set org.gnome.desktop.session idle-delay 0 2>/dev/null || true
 # still run: a missing optional package should not stop the dotfiles being
 # linked. The summary at the end is what decides whether the install worked,
 # because a failure scrolled past twenty minutes ago is a failure nobody saw.
+#
+# Explicit order, not glob order: change-settings runs `vicinae theme set`,
+# which needs both vicinae itself (installed by install-packages) and the
+# theme files it selects among (symlinked into place by link-dotfiles). New
+# scripts must be added here explicitly, or they will not run at all.
+STAGES=(install-packages link-dotfiles change-settings link-vicinae-scripts)
 failed=()
-for script in "$PANAMA_PATH"/setup/scripts/*; do
+for stage in "${STAGES[@]}"; do
+  script="$PANAMA_PATH/setup/scripts/$stage"
   [[ -x "$script" ]] || continue
-  stage="$(basename "$script")"
   printf '\n=== %s ===\n' "$stage"
   if ! "$script"; then
     failed+=("$stage")