WIP: Paused over-hardening fix wave (boot checkout verification, double-read package manifest)

tests/setup/desktop-first-contract

@@ -99,9 +99,10 @@ sed -n '/^if \[\[ "\$ROLE" == server \]\]; then/,/^fi/p' "$installer" | grep -q
 # Comments dropped and backslash continuations joined, so a `soft` invocation
 # wrapped across three lines reads as the one command it is.
 uncommented() { grep -vE '^\s*#' "$installer" | sed -e :a -e '/\\$/N; s/\\\n\s*/ /; ta'; }
+uncommented_installer="$(uncommented)"
 
 while read -r command; do
-    uncommented | grep -q "soft .*$command" \
+    grep -q "soft .*$command" <<<"$uncommented_installer" \
         || note "'$command' runs without soft, so its failure still ends the stage"
 done <<'FRAGILE'
 dnf swap -y 'ffmpeg-free'
@@ -129,7 +130,7 @@ if "rpm -q hyprland" not in after or "exit 1" not in after:
     raise SystemExit(1)
 PY
 
-uncommented | grep -q 'soft .*HYPR_PACKAGES' \
+grep -q 'soft .*HYPR_PACKAGES' <<<"$uncommented_installer" \
     && note 'the Hyprland install is tolerated, so a machine with no desktop reports success'
 
 # ── Soft failures are reported ──────────────────────────────────────────────