Fix the install pipeline and an idle-lock startup race

The initial package list was quoted into a single bogus dnf argument
and every dnf error was discarded, so a fresh install silently skipped
most of it. Two package lists were never wired into the pipeline at
all, and change-settings ran before install-packages, so the vicinae
theme step was permanently skipped. Fixed the ordering, the quoting,
and stopped swallowing errors.

Separately, hypridle could start with its WAYLAND_DISPLAY condition
unmet if it raced the env-publish call, silently never starting --
and it's the only listener for the logind Lock signal. Made the start
wait on the environment synchronously. panama-idle also wrote its
generated config to a fixed temp path with no locking, so concurrent
applies could interleave into a corrupt file; switched to mktemp plus
an atomic mv.

Claude-Session: https://claude.ai/code/session_01E6TJUAh41HaP25MVHWkhRZ

setup/scripts/install-packages

@@ -1,5 +1,7 @@
 #!/usr/bin/env bash
 
+set -euo pipefail
+
 # --- Helper functions ---
 log() { echo -e "\033[1;34m[INFO]\033[0m $*"; }
 exists() { command -v "$1" >/dev/null 2>&1; }
@@ -10,33 +12,37 @@ LOCAL_BIN_PATH="$HOME/.local/bin"
 
 echo -e "\n--- Installing Repositories ---"
 log "Installing RPM Fusion Free and Nonfree Repositories"
-sudo dnf install -y https://mirrors.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm https://mirrors.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm > /dev/null 2>&1
+sudo dnf install -y https://mirrors.rpmfusion.org/free/fedora/rpmfusion-free-release-$(rpm -E %fedora).noarch.rpm https://mirrors.rpmfusion.org/nonfree/fedora/rpmfusion-nonfree-release-$(rpm -E %fedora).noarch.rpm > /dev/null
 log "Enabling Fedora Cisco OpenH264 Repository"
 sudo dnf config-manager setopt fedora-cisco-openh264.enabled=1
 log "Installing RPM Fusion AppStream Metadata"
-sudo dnf update @core -y > /dev/null 2>&1
-sudo dnf install -y rpmfusion-\*-appstream-data > /dev/null 2>&1
+sudo dnf update @core -y > /dev/null
+sudo dnf install -y rpmfusion-\*-appstream-data > /dev/null
 log "Installing Terra Repository"
-sudo dnf install -y --nogpgcheck --repofrompath 'terra,https://repos.fyralabs.com/terra$releasever' terra-release > /dev/null 2>&1
+sudo dnf install -y --nogpgcheck --repofrompath 'terra,https://repos.fyralabs.com/terra$releasever' terra-release > /dev/null
 
 echo -e "\n--- Installing relevant packages ---"
 log "Updating all packages. This may take a while"
-sudo dnf update -y --refresh > /dev/null 2>&1
+sudo dnf update -y --refresh > /dev/null
 
 log "Updating core, multimedia, and sound-and-video groups"
+# A trailing `&& sync` here previously meant a failing groupupdate was exempt
+# from set -e (bash does not apply -e to the left side of a && list), so the
+# failure went unreported. Sync unconditionally on its own line instead.
 sudo dnf4 groupupdate -y 'core' 'multimedia' 'sound-and-video' \
     --setop='install_weak_deps=False' \
     --exclude='PackageKit-gstreamer-plugin' \
-    --allowerasing && sync > /dev/null 2>&1
+    --allowerasing > /dev/null
+sync
 log "Swapping ffmpeg-free for ffmpeg"
-sudo dnf swap -y 'ffmpeg-free' 'ffmpeg' --allowerasing > /dev/null 2>&1
+sudo dnf swap -y 'ffmpeg-free' 'ffmpeg' --allowerasing > /dev/null
 log "Swapping mesa-va-drivers for mesa-va-drivers-freeworld"
-sudo dnf swap -y mesa-va-drivers mesa-va-drivers-freeworld > /dev/null 2>&1
+sudo dnf swap -y mesa-va-drivers mesa-va-drivers-freeworld > /dev/null
 log "Upgrading Multimedia group with optional packages"
-sudo dnf4 group upgrade -y --with-optional Multimedia > /dev/null 2>&1
+sudo dnf4 group upgrade -y --with-optional Multimedia > /dev/null
 log "Installing GStreamer plugins (bad, good, base)"
 sudo dnf install -y gstreamer1-plugins-{bad-\*,good-\*,base} \
-    --exclude=gstreamer1-plugins-bad-free-devel > /dev/null 2>&1
+    --exclude=gstreamer1-plugins-bad-free-devel > /dev/null
 
 # --- Install all initial packages ---
 PACKAGES_FILE="$PANAMA_PATH/setup/packages/initial-packages"
@@ -45,12 +51,25 @@ if [[ -f "$PACKAGES_FILE" ]]; then
 	log "Installing Initial Packages"
   echo -e "Includes the following packages:"
   echo -e "$(<"$PACKAGES_FILE")"
-	sudo dnf install -y "$INITIAL_PACKAGES" > /dev/null 2>&1
+	sudo dnf install -y $INITIAL_PACKAGES > /dev/null
 	log "Initial packages installed!"
 else
 	log "Package list was not in specified path: $PACKAGES_FILE"
 fi
 
+# --- Install Desktop Packages ---
+DESKTOP_FILE="$PANAMA_PATH/setup/packages/desktop-packages"
+if [[ -f "$DESKTOP_FILE" ]]; then
+	DESKTOP_PACKAGES=$(tr "\n" " " <"$DESKTOP_FILE")
+	log "Installing Desktop Packages"
+  echo -e "Includes the following packages:"
+  echo -e "$(<"$DESKTOP_FILE")"
+	sudo dnf install -y $DESKTOP_PACKAGES > /dev/null
+	log "Desktop packages installed!"
+else
+	log "Package list was not in specified path: $DESKTOP_FILE"
+fi
+
 # --- Install oh-my-posh if not already installed. ---
 mkdir -p "$LOCAL_BIN_PATH"
 if [[ -x "$LOCAL_BIN_PATH/oh-my-posh" ]]; then
@@ -67,7 +86,7 @@ if [[ -f "$DEV_FILE" ]]; then
 	log "Installing Development Packages. Mostly for Neovim."
   echo -e "Includes the following packages:"
   echo -e "$(<"$DEV_FILE")"
-  sudo dnf install -y $DEV_PACKAGES > /dev/null 2>&1
+  sudo dnf install -y $DEV_PACKAGES > /dev/null
 	log "Development packages installed!"
 else
 	log "Package list was not in specified path: $DEV_FILE"
@@ -78,12 +97,12 @@ fi
 HYPR_FILE="$PANAMA_PATH/setup/packages/hyprland-packages"
 if [[ -f "$HYPR_FILE" ]]; then
 	log "Enabling Hyprland COPR"
-	sudo dnf copr enable -y lionheartp/Hyprland > /dev/null 2>&1
+	sudo dnf copr enable -y lionheartp/Hyprland > /dev/null
 	HYPR_PACKAGES=$(tr "\n" " " <"$HYPR_FILE")
 	log "Installing Hyprland desktop packages"
 	echo -e "Includes the following packages:"
 	echo -e "$(<"$HYPR_FILE")"
-	sudo dnf install -y --setopt=install_weak_deps=False $HYPR_PACKAGES > /dev/null 2>&1
+	sudo dnf install -y --setopt=install_weak_deps=False $HYPR_PACKAGES > /dev/null
 	log "Hyprland packages installed!"
 else
 	log "Package list was not in specified path: $HYPR_FILE"
@@ -96,3 +115,18 @@ else
   log "Installing Bun via curl..."
   curl -fsSL https://bun.sh/install | bash > /dev/null 2>&1
 fi
+
+# --- Install Flatpak Packages ---
+FLATPAK_FILE="$PANAMA_PATH/setup/packages/flatpak-packages"
+if [[ -f "$FLATPAK_FILE" ]]; then
+	FLATPAK_PACKAGES=$(tr "\n" " " <"$FLATPAK_FILE")
+	log "Adding Flathub remote"
+	sudo flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo > /dev/null
+	log "Installing Flatpak Packages"
+	echo -e "Includes the following packages:"
+	echo -e "$(<"$FLATPAK_FILE")"
+	sudo flatpak install -y flathub $FLATPAK_PACKAGES > /dev/null
+	log "Flatpak packages installed!"
+else
+	log "Package list was not in specified path: $FLATPAK_FILE"
+fi