Fail when failing, stop when stopped, and survive what is neither

Four installer bugs, all in the space between exit codes and intent:

- A flatpak-only extras category -- most of them -- died at the grep
  that filters out its dnf half, because grep exits 1 on zero matches
  and set -e read that as failure. sed deletes lines without editorial
  comment. The extras contract now runs a flatpak-only category under
  the installer's own strict options so this stays fixed.
- A rate-limited GitHub API call aborted the whole package stage while
  resolving the RustDesk URL, even though the empty-result fallback was
  sitting right below it. The pipeline is now guarded so the fallback
  is reachable.
- Ctrl-C did not stop the install: the INT trap ran cleanup and bash
  carried on with the remaining stages, MOK enrollment and firmware
  included. INT and TERM now exit explicitly; cleanup rides EXIT.
- change-settings and link-dotfiles ran without set -e, so a failed
  copy over / or a failed symlink fell through to guarded no-ops and
  the stage reported success. Turning strictness on immediately caught
  what it had been hiding: link-dotfiles never created ~/.config, so on
  a truly fresh HOME every symlink was failing silently.

setup/scripts/link-dotfiles

@@ -1,5 +1,10 @@
 #!/usr/bin/env bash
 
+# Strict: a failed mv or ln here used to fall through and exit 0, so a machine
+# could end up half-linked while the installer's summary reported the stage as
+# fine. Anything genuinely optional below carries its own `|| true`.
+set -euo pipefail
+
 # --- Helper functions ---
 log() { echo -e "\033[1;34m[INFO]\033[0m $*"; }
 
@@ -10,8 +15,10 @@ PANAMA_DOT="$PANAMA_PATH/config/dot"
 PANAMA_OLD="$PANAMA_PATH/config/old"
 CONFIG="$HOME/.config"
 
-# Make backup folder if it doesn't exist
-mkdir -p "$PANAMA_OLD"
+# Make backup folder if it doesn't exist -- and ~/.config itself, which a
+# truly fresh HOME does not have yet. Before set -e above, its absence made
+# every symlink below fail silently while the stage still reported success.
+mkdir -p "$PANAMA_OLD" "$CONFIG"
 
 # --- Bashrc ---
 echo -e "\n--- Replacing .bashrc ---"