Fail when failing, stop when stopped, and survive what is neither

Four installer bugs, all in the space between exit codes and intent:

- A flatpak-only extras category -- most of them -- died at the grep
  that filters out its dnf half, because grep exits 1 on zero matches
  and set -e read that as failure. sed deletes lines without editorial
  comment. The extras contract now runs a flatpak-only category under
  the installer's own strict options so this stays fixed.
- A rate-limited GitHub API call aborted the whole package stage while
  resolving the RustDesk URL, even though the empty-result fallback was
  sitting right below it. The pipeline is now guarded so the fallback
  is reachable.
- Ctrl-C did not stop the install: the INT trap ran cleanup and bash
  carried on with the remaining stages, MOK enrollment and firmware
  included. INT and TERM now exit explicitly; cleanup rides EXIT.
- change-settings and link-dotfiles ran without set -e, so a failed
  copy over / or a failed symlink fell through to guarded no-ops and
  the stage reported success. Turning strictness on immediately caught
  what it had been hiding: link-dotfiles never created ~/.config, so on
  a truly fresh HOME every symlink was failing silently.

setup/scripts/install-packages

@@ -214,9 +214,12 @@ if rpm -q rustdesk >/dev/null 2>&1; then
   log "RustDesk already installed"
 else
   log "Resolving the latest RustDesk release..."
+  # `|| true` because a failed curl -- unauthenticated GitHub API calls get
+  # rate-limited -- would otherwise trip set -e and kill the stage before the
+  # empty-result fallback below could do its job.
   rustdesk_url="$(curl -fsSL https://api.github.com/repos/rustdesk/rustdesk/releases/latest 2>/dev/null \
     | jq -r '.assets[].browser_download_url | select(test("x86_64\\.rpm$")) | select(test("suse") | not)' \
-    | head -1)"
+    | head -1 || true)"
   if [[ -n "$rustdesk_url" ]]; then
     log "Installing RustDesk from $rustdesk_url"
     # The RPM ships rustdesk.service already enabled, which is what provides
@@ -271,7 +274,9 @@ install_extra_category() {
 	name="$(basename "$file")"
 
 	local dnf_packages flatpak_ids
-	dnf_packages=$(catalog_all_targets "$file" | grep -v '^flatpak:' | tr "\n" " ")
+	# sed rather than grep -v: most categories are flatpak-only, and grep exits 1
+	# when it selects nothing, which set -e above turns into a dead stage.
+	dnf_packages=$(catalog_all_targets "$file" | sed '/^flatpak:/d' | tr "\n" " ")
 	flatpak_ids=$(catalog_all_targets "$file" | sed -n 's/^flatpak://p' | tr "\n" " ")
 
 	if [[ -n "${dnf_packages// /}" ]]; then

setup/scripts/link-dotfiles

@@ -1,5 +1,10 @@
 #!/usr/bin/env bash
 
+# Strict: a failed mv or ln here used to fall through and exit 0, so a machine
+# could end up half-linked while the installer's summary reported the stage as
+# fine. Anything genuinely optional below carries its own `|| true`.
+set -euo pipefail
+
 # --- Helper functions ---
 log() { echo -e "\033[1;34m[INFO]\033[0m $*"; }
 
@@ -10,8 +15,10 @@ PANAMA_DOT="$PANAMA_PATH/config/dot"
 PANAMA_OLD="$PANAMA_PATH/config/old"
 CONFIG="$HOME/.config"
 
-# Make backup folder if it doesn't exist
-mkdir -p "$PANAMA_OLD"
+# Make backup folder if it doesn't exist -- and ~/.config itself, which a
+# truly fresh HOME does not have yet. Before set -e above, its absence made
+# every symlink below fail silently while the stage still reported success.
+mkdir -p "$PANAMA_OLD" "$CONFIG"
 
 # --- Bashrc ---
 echo -e "\n--- Replacing .bashrc ---"