Ask for the password once, and own the plugin the COPR needs

Two ways a fresh machine's unattended run could still stall. The stages call
sudo dozens of times across twenty-plus minutes, and the timestamp expires
five minutes after whichever call came last -- so any single dnf step that
outlasted it turned the next stage into a password prompt nobody was there to
answer. ./install now authenticates once, right after the interview, and a
refresher holds the timestamp for exactly as long as the script lives;
cleanup() kills it on every exit path, so nothing outlives the install with
ambient credentials.

And `dnf copr` comes from dnf5-plugins, which a machine that has used copr
carries and a fresh Workstation does not -- a missing plugin there would have
cost the entire desktop. Declared in initial-packages, where the repositories
stage can rely on it.

Claude-Session: https://claude.ai/code/session_01Epx9ZC1gwm81K3jm9x9CKh

install

@@ -37,6 +37,7 @@ cleanup() {
   # Deleted on every exit path, including Ctrl-C. The answers are transient by
   # design, and one of them is an email address.
   [[ -n "${PANAMA_ANSWERS:-}" ]] && rm -f "$PANAMA_ANSWERS"
+  [[ -n "${SUDO_KEEPALIVE:-}" ]] && kill "$SUDO_KEEPALIVE" 2>/dev/null
 }
 trap cleanup EXIT
 # A bare `trap cleanup INT` is not an abort: bash runs the handler and then
@@ -87,10 +88,20 @@ export PANAMA_HOSTNAME PANAMA_GIT_NAME PANAMA_GIT_EMAIL PANAMA_GIT_EDITOR \
        PANAMA_GH_LOGIN PANAMA_SSH_KEY PANAMA_NVIDIA PANAMA_MOK_HASH \
        PANAMA_DEBLOAT PANAMA_FIRMWARE PANAMA_EXTRAS PANAMA_USER_CONTENT
 
+# One password, before anything long runs, and then never again. The stages
+# call sudo dozens of times across twenty-plus minutes, and the timestamp
+# expires five minutes after whichever call came last -- so a single dnf step
+# that outlasts it turned the next stage into a password prompt nobody was
+# there to answer. The refresher holds the timestamp open for exactly as long
+# as this script lives; cleanup() kills it on every exit path, so nothing
+# outlives the install with ambient credentials.
+echo "Panama needs administrator rights for the rest of the run."
+sudo -v || exit 1
+( while kill -0 "$$" 2>/dev/null; do sudo -n true 2>/dev/null || true; sleep 60; done ) &
+SUDO_KEEPALIVE=$!
+
 # Applied here rather than in a stage, and applied early: it needs sudo, and
-# sudo is warm right now. At the end of a long unattended run the timestamp has
+# sudo is warm right now.
-# expired, and a password prompt then is exactly the interruption the interview
-# exists to prevent.
 if [[ -n "${PANAMA_HOSTNAME:-}" ]]; then
   sudo hostnamectl set-hostname "$PANAMA_HOSTNAME"
   echo "Hostname set to: $(hostname)"

setup/packages/initial-packages

@@ -3,6 +3,10 @@ bat
 btop
 cargo
 curl
+# `dnf copr`, which install-packages needs to enable the Hyprland COPR. A
+# machine that has used copr before has it; a fresh Workstation install does
+# not, and the failure would cost the entire desktop.
+dnf5-plugins
 eza
 # install-packages installs flatpaks with it; Fedora Workstation ships it,
 # but a minimal install does not.