Let a machine say what it is for, and give Firefox its face back

Phase 4: the optional application categories, and the Firefox chrome.

Everything Panama installed until now was what every machine gets, which meant a
work laptop acquired emulators and a desktop that wanted Steam had to be told
about it by hand. The interview now offers the categories in
setup/packages/extras/ as a checklist -- gaming, creative, communication,
virtualization -- and nothing is preselected, because a default here installs
applications nobody chose on a machine whose owner answered a question they
thought was about something else.

A category is one file, and a category mixes both package managers because the
applications do: Steam is in RPM Fusion, Slack publishes only a flatpak. So a
bare line is a dnf package and a flatpak: line is a Flathub ID, and one file
holds the whole answer rather than splitting each category across two. The menu
is read from the directory rather than written down, so adding a category is
adding a file. Every name in all four was resolved against the actual
repositories before being written down, and the contract re-resolves them --
the point of admitting applications one at a time is that they stay installable,
and a typo here fails on somebody else's machine, not this one.

Firefox is declared, and its chrome is Edge-Frfox, vendored into config/firefox.
sunhat carried that theme with no license and no attribution; it is MIT, and now
it says so and says whose it is.

It is the only piece of Panama's configuration that does not go to a path this
repository chooses. Firefox owns the profile directory, names it with a random
salt, and does not create one until the browser has been run -- so link-dotfiles
finds or creates a profile and links both halves into it. Both, or neither works:
chrome/ is the CSS and user.js sets the preference that makes Firefox read chrome/
at all, without which the theme is a directory of dead files.

Two assumptions there were wrong, and the contract exists for both. Firefox has
moved to the XDG directories -- the profile root is ~/.config/mozilla/firefox on
this build, not ~/.mozilla/firefox, and writing to the wrong one themes nothing
and says nothing about it. And -CreateProfile turns out to be non-interactive, so
a fresh machine gets the theme on the first install rather than the second. The
contract runs link-dotfiles for real against a throwaway home with no profile in
it and looks at what came out; it was checked by pointing the search at the
legacy path only and watching it fail.

Also: the enrolment/enrollment spellings from the last commit are corrected. This
repository is US-spelled everywhere else -- color 1131 times against colour never
-- and consistency in prose is worth as much as it is in code.

Claude-Session: https://claude.ai/code/session_01NvgBuSWB5sE43yWmg21ozj

setup/scripts/install-packages

@@ -180,3 +180,50 @@ if [[ -f "$FLATPAK_FILE" ]]; then
 else
 	log "Package list was not in specified path: $FLATPAK_FILE"
 fi
+
+# --- Install the extras that were chosen ------------------------------------
+#
+# Everything above is what every Panama machine gets. This is what one machine
+# asked for: the interview offers the categories in setup/packages/extras/ as a
+# checklist and records the chosen names, so a work laptop does not acquire
+# emulators and a desktop does not skip Steam.
+#
+# Absent means none. That is what makes this stage safe to re-run by hand while
+# repairing one piece of a machine -- and it means a category is installed only
+# by an explicit answer, never by a default that drifted.
+#
+# A category mixes both package managers, because the applications do: some are
+# in Fedora or RPM Fusion and some publish only a flatpak. A bare line is a dnf
+# package and a `flatpak:` line is a Flathub ID, so one file per category holds
+# the whole answer rather than splitting each category across two.
+#
+# Neither install is fatal. A category is a set of applications somebody wanted,
+# not a dependency of the desktop, and losing the rest of the run because one of
+# them was renamed upstream would be the wrong trade.
+install_extra_category() {
+	local file="$1" name
+	name="$(basename "$file")"
+
+	local dnf_packages flatpak_ids
+	dnf_packages=$(packages_in "$file" | tr ' ' '\n' | grep -v '^flatpak:' | tr "\n" " ")
+	flatpak_ids=$(packages_in "$file" | tr ' ' '\n' | sed -n 's/^flatpak://p' | tr "\n" " ")
+
+	if [[ -n "${dnf_packages// /}" ]]; then
+		log "Installing $name: $dnf_packages"
+		sudo dnf install -y $dnf_packages > /dev/null || log "Some $name packages did not install"
+	fi
+	if [[ -n "${flatpak_ids// /}" ]]; then
+		log "Installing $name flatpaks: $flatpak_ids"
+		sudo flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo > /dev/null
+		sudo flatpak install -y flathub $flatpak_ids > /dev/null || log "Some $name flatpaks did not install"
+	fi
+}
+
+EXTRAS_DIR="$PANAMA_PATH/setup/packages/extras"
+for extra in ${PANAMA_EXTRAS:-}; do
+	if [[ -f "$EXTRAS_DIR/$extra" ]]; then
+		install_extra_category "$EXTRAS_DIR/$extra"
+	else
+		log "No such extras category: $extra"
+	fi
+done