Assert the installer's process isolation, not its formatting

panama-command-install-contract matched the literal string
`do "$script"; done`, so it failed the moment that loop gained error
reporting and spanned more than one line -- while the property it exists
to protect, each setup stage running in its own process, was unchanged.

It now checks that property directly: the installer must not source
anything under setup/scripts, and must execute them. Verified it still
catches an installer rewritten to source its stages, which the
first attempt at the replacement did not -- the pattern anchored to the
start of a line, and the sourcing appeared mid-line behind an `if`.

Claude-Session: https://claude.ai/code/session_01BRvzt4H8XXLPVH5MyYdk9L

tests/quickshell/panama-command-install-contract.sh

@@ -25,8 +25,16 @@ trap cleanup EXIT
 if rg -q 'setup/scripts/link-vicinae-scripts' "$dotfile_installer"; then
     fail 'link-dotfiles also invokes the command installer'
 fi
-rg -Fq 'do "$script"; done' "$top_level_installer" \
-    || fail 'top-level installer sources setup scripts into one shared shell'
+# Each setup stage must run in its OWN process, so strict-shell options and
+# helper variables stay local to the script that owns them. What matters is
+# that the stages are executed rather than sourced -- this previously matched
+# the literal one-liner `do "$script"; done`, which failed the moment the loop
+# gained error reporting and spanned more than one line, despite the property
+# it cares about being unchanged.
+rg -q '(^|[^a-z-])(\.|source)\s+[^;]*setup/scripts' "$top_level_installer" \
+    && fail 'top-level installer sources setup scripts into one shared shell'
+rg -q '"\$script"' "$top_level_installer" \
+    || fail 'top-level installer does not execute the setup scripts'
 
 mkdir -p "$data_dir/scripts/panama" "$fake_bin"
 printf 'user-owned\n' >"$data_dir/scripts/panama/keep.sh"