Ask for the password once, and own the plugin the COPR needs

Two ways a fresh machine's unattended run could still stall. The stages call
sudo dozens of times across twenty-plus minutes, and the timestamp expires
five minutes after whichever call came last -- so any single dnf step that
outlasted it turned the next stage into a password prompt nobody was there to
answer. ./install now authenticates once, right after the interview, and a
refresher holds the timestamp for exactly as long as the script lives;
cleanup() kills it on every exit path, so nothing outlives the install with
ambient credentials.

And `dnf copr` comes from dnf5-plugins, which a machine that has used copr
carries and a fresh Workstation does not -- a missing plugin there would have
cost the entire desktop. Declared in initial-packages, where the repositories
stage can rely on it.

Claude-Session: https://claude.ai/code/session_01Epx9ZC1gwm81K3jm9x9CKh

setup/packages/initial-packages

@@ -3,6 +3,10 @@ bat
 btop
 cargo
 curl
+# `dnf copr`, which install-packages needs to enable the Hyprland COPR. A
+# machine that has used copr before has it; a fresh Workstation install does
+# not, and the failure would cost the entire desktop.
+dnf5-plugins
 eza
 # install-packages installs flatpaks with it; Fedora Workstation ships it,
 # but a minimal install does not.