Install ChatGPT Desktop from a repository this checkout can verify

OpenAI ships an official Linux RPM now, so the community wrapper goes away:
`panama app chatgpt-desktop` built codex-desktop from the upstream macOS disk
image and ran a local rebuild daemon to keep it current, and the official
package comes from a repository that upgrades with everything else. The app
file, the help example and the dock's pinned id all move over, and a migration
replaces the build on machines that already have it -- official package on
before the community one comes off, so a failure part-way still leaves an app.

The install itself does not follow upstream's instructions. Those are "download
this RPM and install it", and the RPM's own root scriptlet is what writes the
repository file and drops the signing key into /etc/pki/rpm-gpg -- so root runs
an unverified download and then learns from it what to trust. That is the shape
the repository audit forbids: no network response is executed as root without a
verified digest or signature first.

OpenAI publishes no key and no fingerprint anywhere an install could fetch and
check them, so the key is pinned here instead. setup/keys/ carries it and says
where it came from, including the honest part -- this is trust established on
first use and then held, not trust verified against the publisher. setup/lib/
chatgpt-package verifies that copy's fingerprint, installs it, and writes the
repository with gpgcheck and repo_gpgcheck on before anything is installed, so
dnf checks the metadata signature and the package signature itself. It is byte
for byte the repository the scriptlet would have written, so nothing churns
afterwards, and every later upgrade goes through the same key. Both callers use
it; a verification failure skips ChatGPT rather than installing it anyway.

The contract proves the pinned key is the key the library names, that a
missing, unreadable or mismatched key writes nothing at all, that what is
written actually turns the checks on, and that neither caller hands root a
downloaded RPM.

Claude-Session: https://claude.ai/code/session_017zzbtfnMLoYrB8WesqANFY

setup/scripts/install-packages

@@ -79,6 +79,11 @@ source "$PANAMA_PATH/setup/lib/extras-catalog"
 source "$PANAMA_PATH/setup/lib/machine-role"
 ROLE="$(panama_role)"
 
+# Establishing the verified ChatGPT repository, shared with the migration that
+# replaces the community build, so neither can install it a less careful way.
+# shellcheck source=../lib/chatgpt-package
+source "$PANAMA_PATH/setup/lib/chatgpt-package"
+
 # One list, installed the way every list is installed: --skip-unavailable so a
 # single rotted name cannot cost the transaction, then report_missing so a
 # skipped name is a warning somebody reads.
@@ -369,6 +374,28 @@ else
     || { log "Claude Desktop install failed; skipping"; softly_failed+=("Claude Desktop"); }
 fi
 
+# ChatGPT Desktop: OpenAI ships an official Linux RPM now. Panama used to build
+# a community wrapper from the macOS disk image -- it was `panama app
+# chatgpt-desktop` -- because no packaged form existed; that build froze often
+# and carried its own local rebuild daemon. The official package is strictly
+# better: it comes from a repository, so it upgrades with every other package
+# from then on.
+#
+# The repository and its signing key are established first, from the copy
+# pinned in setup/keys/, so dnf verifies the metadata and the package before
+# either reaches root. Upstream's own instructions do not allow that -- see
+# setup/lib/chatgpt-package for why they are not followed here.
+if rpm -q chatgpt >/dev/null 2>&1; then
+  log "ChatGPT Desktop already installed"
+elif ! chatgpt_install_repository sudo; then
+  log "Could not establish the verified ChatGPT repository; skipping"
+  softly_failed+=("ChatGPT Desktop")
+else
+  log "Installing ChatGPT Desktop..."
+  sudo dnf install -y chatgpt > /dev/null \
+    || { log "ChatGPT Desktop install failed; skipping"; softly_failed+=("ChatGPT Desktop"); }
+fi
+
 # RustDesk: remote desktop. The flatpak cannot register the root-owned system
 # service that unattended access needs -- see panama-doctor's rustdesk check --
 # so this takes the RPM. The download URL is resolved from the latest release