Fail when failing, stop when stopped, and survive what is neither

Four installer bugs, all in the space between exit codes and intent:

- A flatpak-only extras category -- most of them -- died at the grep
  that filters out its dnf half, because grep exits 1 on zero matches
  and set -e read that as failure. sed deletes lines without editorial
  comment. The extras contract now runs a flatpak-only category under
  the installer's own strict options so this stays fixed.
- A rate-limited GitHub API call aborted the whole package stage while
  resolving the RustDesk URL, even though the empty-result fallback was
  sitting right below it. The pipeline is now guarded so the fallback
  is reachable.
- Ctrl-C did not stop the install: the INT trap ran cleanup and bash
  carried on with the remaining stages, MOK enrollment and firmware
  included. INT and TERM now exit explicitly; cleanup rides EXIT.
- change-settings and link-dotfiles ran without set -e, so a failed
  copy over / or a failed symlink fell through to guarded no-ops and
  the stage reported success. Turning strictness on immediately caught
  what it had been hiding: link-dotfiles never created ~/.config, so on
  a truly fresh HOME every symlink was failing silently.

tests/setup/interview-contract

@@ -52,8 +52,15 @@ done <<<"$consumed"
 
 # ── 3. Nothing is left behind ────────────────────────────────────────────────
 
-grep -q 'trap cleanup EXIT INT TERM' "$install_script" \
-    || note 'install does not arm a cleanup trap on EXIT INT TERM'
+# Cleanup rides the EXIT trap; INT and TERM must exit explicitly, because a
+# trap handler that merely cleans up lets bash carry on with the remaining
+# stages after a Ctrl-C -- MOK enrollment and firmware included.
+grep -q 'trap cleanup EXIT' "$install_script" \
+    || note 'install does not arm a cleanup trap on EXIT'
+grep -qE "trap 'exit [0-9]+' INT" "$install_script" \
+    || note 'install does not exit on SIGINT, so Ctrl-C would keep installing'
+grep -qE "trap 'exit [0-9]+' TERM" "$install_script" \
+    || note 'install does not exit on SIGTERM, so a kill would keep installing'
 grep -q 'rm -f "$PANAMA_ANSWERS"' "$install_script" \
     || note 'the cleanup trap does not delete the answers file'
 grep -qE 'mktemp' "$install_script" \