Merge branch 'main' into codex/repo-audit-remediation-package-2

# Conflicts:
#	README.md
#	setup/scripts/install-packages

setup/scripts/install-packages

@@ -89,6 +89,11 @@ source "$PANAMA_PATH/setup/lib/extras-catalog"
 source "$PANAMA_PATH/setup/lib/machine-role"
 ROLE="$(panama_role)"
 
+# Establishing the verified ChatGPT repository, shared with the migration that
+# replaces the community build, so neither can install it a less careful way.
+# shellcheck source=../lib/chatgpt-package
+source "$PANAMA_PATH/setup/lib/chatgpt-package"
+
 # One list, installed the way every list is installed: --skip-unavailable so a
 # single rotted name cannot cost the transaction, then report_missing so a
 # skipped name is a warning somebody reads.
@@ -1299,6 +1304,28 @@ if ! install_claude_desktop_if_trusted; then
 	softly_failed+=("Claude Desktop")
 fi
 
+# ChatGPT Desktop: OpenAI ships an official Linux RPM now. Panama used to build
+# a community wrapper from the macOS disk image -- it was `panama app
+# chatgpt-desktop` -- because no packaged form existed; that build froze often
+# and carried its own local rebuild daemon. The official package is strictly
+# better: it comes from a repository, so it upgrades with every other package
+# from then on.
+#
+# The repository and its signing key are established first, from the copy
+# pinned in setup/keys/, so dnf verifies the metadata and the package before
+# either reaches root. Upstream's own instructions do not allow that -- see
+# setup/lib/chatgpt-package for why they are not followed here.
+if rpm -q chatgpt >/dev/null 2>&1; then
+  log "ChatGPT Desktop already installed"
+elif ! chatgpt_install_repository sudo; then
+  log "Could not establish the verified ChatGPT repository; skipping"
+  softly_failed+=("ChatGPT Desktop")
+else
+  log "Installing ChatGPT Desktop..."
+  sudo dnf install -y chatgpt > /dev/null \
+    || { log "ChatGPT Desktop install failed; skipping"; softly_failed+=("ChatGPT Desktop"); }
+fi
+
 # The RPM ships rustdesk.service already enabled, which is what provides
 # unattended access; Panama deliberately does not start it a second time.
 install_rustdesk || true