Drop the extension, and give the test suite a front door

Phase 6, the last of the fresh-install spec.

159 scripts lose their .sh: 110 contracts, 47 Vicinae commands, 2 compositor
contracts. A shebang and the executable bit already select the interpreter. The
extension only ever added something that had to stay in sync, and the rename
proved the point twice over in the space of an hour.

The spec's stated risk was Vicinae's script discovery. One script was renamed and
reloaded on its own before the other 46 followed; it came back as
scripts:panama.capture and all 47 resolve. What the probe turned up instead is
that the extension was never only a filename: Vicinae's command IDs embed it, so
every ID changed. Nothing in this repository refers to them, so nothing breaks.
The only trace is Vicinae's metadata.json, whose visited map had two Panama
entries that are now orphaned -- two commands lost their usage ranking and will
earn it back. Worth knowing before anyone renames these again on a machine that
has a keybind pointing at one.

Rewriting the references by exact filename missed two things it structurally
could not see: a name built from a variable, settings-$page.sh, and a glob,
-name '*.sh'. Both were in the contract that counts the generated commands, which
promptly reported 47 expected and 0 found. The mechanical part of a rename is the
part that looks finished.

The three subcommands. panama doctor fronts a health check that already existed
and already ran at the end of every install but could not be reached from a
terminal. panama upgrade re-runs the installer from anywhere. panama test runs
the suite, which had no entry point at all -- 121 files that were the main safety
net in this repository and were invisible in it.

Writing that runner found three tests nothing was running.
calendar_agenda_bridge_test, home_assistant_bridge_test and kdeconnect_bridge_test
are unittest suites without the executable bit, so no contract invoked them and
the first draft of the runner skipped them silently. All three pass, and have
passed unobserved for weeks. The runner collects *_test.py as well now, because a
runner with a blind spot is worse than no runner for the same reason a dependency
checker with one is: it reports PASS.

Six worktrees pruned. Each was re-checked rather than trusted to the spec's list,
and two needed it: panama-commands is not on feat/panama-commands but on
feat/gnome-tweaks-parity, and fix/panama-displays-review reads [ahead 3] -- ahead
of its remote, not of main, with every commit patch-equivalent to landed work.
roadmap-completion stays; it has five commits that are genuinely unlanded. The
branches are left alone: pruning a worktree costs nothing, deleting a branch is a
decision.

121 contracts pass.

Claude-Session: https://claude.ai/code/session_01NvgBuSWB5sE43yWmg21ozj

docs/superpowers/specs/2026-08-20-panama-fresh-install-design.md

@@ -16,7 +16,7 @@ notification server, and a Settings application with thirty-odd pages. Almost al
 of it was verified against a running system. Almost none of it was verified against
 a system where Panama had just been installed for the first time.
 
-The existing `tests/quickshell/declared-dependencies-contract.sh` was written for
+The existing `tests/quickshell/declared-dependencies-contract` was written for
 exactly this class of bug and reports PASS, because it checks only commands that
 scripts invoke. Fonts, cursor themes, wallpapers, and packages consumed by GUI
 handoffs are invisible to it. A dependency checker with a blind spot is worse than
@@ -314,8 +314,17 @@ this way:
 
 - `panama doctor` — front `panama-doctor` from a terminal, not only from Settings
 - `panama test` — run every contract under `tests/`, with a pass/fail summary. The
-  suite is 119 files with no entry point and no mention in the README; it is the
-  main safety net and it is currently invisible.
+  suite had no entry point and no mention in the README; it is the main safety net
+  and it was invisible.
+
+  Building the runner found three tests that nothing was running.
+  `calendar_agenda_bridge_test.py`, `home_assistant_bridge_test.py` and
+  `kdeconnect_bridge_test.py` are `unittest` suites without the executable bit, so
+  no contract invoked them and the first draft of this runner skipped them in
+  silence. All three pass, and have presumably passed unobserved for weeks. The
+  runner now collects `*_test.py` as well, because a runner with a blind spot is
+  worse than no runner for the same reason a dependency checker with one is: it
+  reports PASS.
 - `panama upgrade` — re-run `./install` from anywhere
 
 ### Dropping the `.sh` extension
@@ -324,7 +333,7 @@ this way:
 `config/local/share/vicinae/scripts`, 2 under `tests/hypr`. All are already
 executable and all already carry a bash shebang, so the rename is `git mv` plus
 three comment references and two lines in `panama-settings-commands`, which
-generates the Vicinae command files and globs for `settings-*.sh`.
+generates the Vicinae command files and globs for `settings-*`.
 
 The one real risk is Vicinae's script discovery. Its documentation states a script
 command needs a plain text file, the three `@vicinae.*` directives, a shebang, and
@@ -334,6 +343,19 @@ to act on, but not close enough to skip verifying: after the rename, reload with
 before the change is considered done. If discovery does key off the extension, the
 Vicinae directory is exempted and the reason recorded here.
 
+**Verified, and discovery does not.** One script was renamed first and reloaded on
+its own; it came back as `scripts:panama.capture`, so the whole set followed and
+all 47 resolve.
+
+What the probe did turn up is that the extension was never only a filename:
+Vicinae's command IDs embed it, so every ID changed — `scripts:panama.capture.sh`
+became `scripts:panama.capture`. Nothing in this repository refers to those IDs,
+so nothing breaks. The only trace is Vicinae's own `metadata.json`, whose
+`visited` map had two Panama entries that are now orphaned; the effect is that two
+commands lost their usage ranking and will earn it back. Worth knowing before
+renaming these files again, and worth checking for a keybind or deeplink first on
+a machine that has one.
+
 ### Machine-specific configuration
 
 Monitor layout, keybinds and input differences stay in gitignored local state —
@@ -422,10 +444,17 @@ installer. They remain recoverable from sunhat's git history.
   hardening, with its own spec and plan. It does not conflict with this work — it
   *depends* on it, since its lock generator falls back to the shipped wallpaper this
   spec makes exist. Rebasing it is its own task.
-- Six worktrees remain on branches already merged to `main`
+- **Done.** Six worktrees remained on branches already merged to `main`
   (`home-accessories-customization`, `panama-commands`, `panama-displays-review`,
-  `panama-settings-home-phone`, `settings-notification-rules`, `settings-ownership`).
-  They are clutter, not risk; pruning them stays in phase 6.
+  `panama-settings-home-phone`, `settings-notification-rules`, `settings-ownership`),
+  and all six are pruned. Each was re-checked rather than trusted to this list:
+  `git cherry main <branch>` reported nothing unique and every working tree was
+  clean. Two needed the check. `panama-commands` is not on `feat/panama-commands`
+  at all but on `feat/gnome-tweaks-parity` — the directory name and the branch had
+  drifted apart. And `fix/panama-displays-review` reads `[ahead 3]`, which is ahead
+  of its *remote*, not of `main`; all three commits are patch-equivalent to work
+  already landed. The branches themselves are left alone: pruning a worktree costs
+  nothing, and deleting a branch is somebody's decision rather than tidying.
 - Guard the `.cargo/env` source in `config/bash/.bashrc` and remove the Codex block.
 - Rewrite the README: one desktop, the real install stages, and the test suite.
 - **Done, and it needed nothing.** `docs/settings.md` is generated from