Fail when failing, stop when stopped, and survive what is neither

Four installer bugs, all in the space between exit codes and intent:

- A flatpak-only extras category -- most of them -- died at the grep
  that filters out its dnf half, because grep exits 1 on zero matches
  and set -e read that as failure. sed deletes lines without editorial
  comment. The extras contract now runs a flatpak-only category under
  the installer's own strict options so this stays fixed.
- A rate-limited GitHub API call aborted the whole package stage while
  resolving the RustDesk URL, even though the empty-result fallback was
  sitting right below it. The pipeline is now guarded so the fallback
  is reachable.
- Ctrl-C did not stop the install: the INT trap ran cleanup and bash
  carried on with the remaining stages, MOK enrollment and firmware
  included. INT and TERM now exit explicitly; cleanup rides EXIT.
- change-settings and link-dotfiles ran without set -e, so a failed
  copy over / or a failed symlink fell through to guarded no-ops and
  the stage reported success. Turning strictness on immediately caught
  what it had been hiding: link-dotfiles never created ~/.config, so on
  a truly fresh HOME every symlink was failing silently.

tests/setup/extras-contract

@@ -115,6 +115,31 @@ if grep 'flatpak install' <<<"$recorded" | grep -q 'from-dnf'; then
     note 'a dnf package is passed to flatpak'
 fi
 
+# A flatpak-only category -- which most of the real ones are -- must survive
+# the installer's own strict options. Filtering the dnf half with `grep -v`
+# once left an exit 1 for zero matches, and set -e killed the stage before its
+# flatpak half ran. Run under those options, not the contract's laxer ones;
+# the status is captured rather than `||`-guarded because a condition context
+# would switch errexit off inside the subshell and hide the very failure this
+# pins.
+: >"$calls"
+flatpak_only="$work/flatpak-only"
+printf 'flatpak:org.example.OnlyFlatpak\n' >"$flatpak_only"
+(
+    set -euo pipefail
+    PATH="$stub_dir:$PATH"
+    log() { :; }
+    source "$catalog"
+    eval "$filter"
+    eval "$loop"
+    install_extra_category "$flatpak_only"
+)
+flatpak_only_status=$?
+(( flatpak_only_status == 0 )) \
+    || note 'a flatpak-only category aborts the installer under set -euo pipefail'
+grep -q 'flatpak install -y flathub org.example.OnlyFlatpak' <<<"$(cat "$calls" 2>/dev/null)" \
+    || note 'a flatpak-only category installs nothing'
+
 # Choosing nothing installs nothing.
 : >"$calls"
 (