Fail when failing, stop when stopped, and survive what is neither

Four installer bugs, all in the space between exit codes and intent:

- A flatpak-only extras category -- most of them -- died at the grep
  that filters out its dnf half, because grep exits 1 on zero matches
  and set -e read that as failure. sed deletes lines without editorial
  comment. The extras contract now runs a flatpak-only category under
  the installer's own strict options so this stays fixed.
- A rate-limited GitHub API call aborted the whole package stage while
  resolving the RustDesk URL, even though the empty-result fallback was
  sitting right below it. The pipeline is now guarded so the fallback
  is reachable.
- Ctrl-C did not stop the install: the INT trap ran cleanup and bash
  carried on with the remaining stages, MOK enrollment and firmware
  included. INT and TERM now exit explicitly; cleanup rides EXIT.
- change-settings and link-dotfiles ran without set -e, so a failed
  copy over / or a failed symlink fell through to guarded no-ops and
  the stage reported success. Turning strictness on immediately caught
  what it had been hiding: link-dotfiles never created ~/.config, so on
  a truly fresh HOME every symlink was failing silently.

install

@@ -38,7 +38,13 @@ cleanup() {
   # design, and one of them is an email address.
   [[ -n "${PANAMA_ANSWERS:-}" ]] && rm -f "$PANAMA_ANSWERS"
 }
-trap cleanup EXIT INT TERM
+trap cleanup EXIT
+# A bare `trap cleanup INT` is not an abort: bash runs the handler and then
+# carries on with the script, so Ctrl-C would kill only the current stage and
+# the remaining ones -- MOK enrollment, firmware -- would still run. Exit
+# explicitly instead; the EXIT trap above does the actual cleanup.
+trap 'exit 130' INT
+trap 'exit 143' TERM
 
 gsettings set org.gnome.desktop.screensaver lock-enabled false 2>/dev/null || true
 gsettings set org.gnome.desktop.session idle-delay 0 2>/dev/null || true