Snapper: no question on btrfs; vendor the SysGuides scripts

- On btrfs, snapshots + zstd compression now just happen (no prompt);
  --snapper=no remains the explicit opt-out.
- Vendor scripts/snapper-*.sh + config/snapper.actions from
  SysGuides/sysguides-snapper-fedora (MIT, upstream 0a28eb4) into
  vendor/snapper/ and install from there — no runtime clone of an
  external repo, and no dependency on exec bits (fixes the
  './install.sh: Permission denied' failure seen on the test VM).
- grub-btrfs still cloned at runtime from Antynea/grub-btrfs with the
  Fedora config applied; everything else is local now.

lib/common.sh

@@ -258,9 +258,14 @@ ensure_btrfs_compression() {
     info "    sudo mount -o remount /  &&  sudo mount -o remount /home"
 }
 
-# Full snapshot setup via the SysGuides installer (snapper + grub-btrfs +
-# DNF5 pre/post snapshot actions). The installer re-validates btrfs itself.
+# Snapshot setup using the vendored SysGuides scripts (vendor/snapper/).
+# Original: https://github.com/SysGuides/sysguides-snapper-fedora (MIT).
+# Vendored so we do not depend on that repo at runtime; upstream changes can
+# be pulled deliberately, not accidentally.
+# Exec bits are not relied on: scripts are invoked via `bash`.
 setup_snapper() {
+    local vendor="$SCRIPT_DIR/vendor/snapper"
+
     if pkg_installed snapper && [[ -d /.snapshots ]]; then
         ok "Snapper already configured (config for / exists)."
         return 0
@@ -269,17 +274,57 @@ setup_snapper() {
         warn "Root filesystem is not btrfs; skipping snapshot setup."
         return 0
     fi
-    info "Setting up snapper + grub-btrfs (SysGuides installer)..."
+    if [[ ! -f "$vendor/scripts/snapper-pre.sh" ]]; then
+        err "Vendored snapper scripts missing at $vendor — repo checkout incomplete?"
+        return 1
+    fi
+
+    info "Installing snapper + grub-btrfs packages..."
+    install_packages snapper libdnf5-plugin-actions btrfs-assistant inotify-tools make git
+
+    info "Creating snapper configs (root + home)..."
+    [[ -d /.snapshots ]]    || sudo snapper -c root create-config /
+    [[ -d /home/.snapshots ]] || sudo snapper -c home create-config /home
+    sudo restorecon -RF /.snapshots /home/.snapshots 2>/dev/null || true
+
+    local real_user="${SUDO_USER:-$USER}"
+    sudo snapper -c root set-config ALLOW_USERS="$real_user" SYNC_ACL=yes
+    sudo snapper -c home set-config ALLOW_USERS="$real_user" SYNC_ACL=yes
+    # no home timeline: snapshots of your own files on every dnf run are noise
+    sudo snapper -c home set-config TIMELINE_CREATE=no
+
+    info "Excluding .snapshots from updatedb..."
+    if grep -q '^PRUNENAMES' /etc/updatedb.conf 2>/dev/null; then
+        grep -q '\.snapshots' /etc/updatedb.conf || \
+            sudo sed -i 's|^PRUNENAMES *= *"|PRUNENAMES = ".snapshots |' /etc/updatedb.conf
+    else
+        printf 'PRUNENAMES = ".snapshots"\n' | sudo tee -a /etc/updatedb.conf >/dev/null
+    fi
+
+    info "Installing grub-btrfs (from source, Antynea/grub-btrfs)..."
     local tmp
     tmp=$(mktemp -d)
-    git clone --depth 1 https://github.com/SysGuides/sysguides-snapper-fedora "$tmp/sysguides" \
-        || { err "Could not clone the SysGuides installer."; rm -rf "$tmp"; return 1; }
-    ( cd "$tmp/sysguides" && ./install.sh )
-    local rc=$?
+    git clone --quiet --depth 1 https://github.com/Antynea/grub-btrfs "$tmp/grub-btrfs"
+    sed -i \
+        -e 's|^#GRUB_BTRFS_SNAPSHOT_KERNEL_PARAMETERS=.*|GRUB_BTRFS_SNAPSHOT_KERNEL_PARAMETERS="rd.live.overlay.overlayfs=1"|' \
+        -e 's|^#GRUB_BTRFS_GRUB_DIRNAME=.*|GRUB_BTRFS_GRUB_DIRNAME="/boot/grub2"|' \
+        -e 's|^#GRUB_BTRFS_MKCONFIG=.*|GRUB_BTRFS_MKCONFIG=/usr/bin/grub2-mkconfig|' \
+        -e 's|^#GRUB_BTRFS_SCRIPT_CHECK=.*|GRUB_BTRFS_SCRIPT_CHECK=grub2-script-check|' \
+        "$tmp/grub-btrfs/config"
+    sudo make -C "$tmp/grub-btrfs" install
+    sudo systemctl enable --now grub-btrfsd.service
+    sudo grub2-mkconfig -o /boot/grub2/grub.cfg
     rm -rf "$tmp"
-    if (( rc == 0 )); then
-        ok "Snapper + grub-btrfs installed. Every dnf transaction now gets a pre/post snapshot."
-        info "Try it:  snapper ls   |   snapper status 1..2   |   sudo snapper undochange 1..2"
-    fi
-    return $rc
+
+    info "Installing DNF5 snapper integration (vendored scripts)..."
+    sudo install -m 755 "$vendor"/scripts/* /usr/local/bin/
+    sudo restorecon -v /usr/local/bin/snapper-*.sh 2>/dev/null || true
+    sudo mkdir -p /etc/dnf/libdnf5-plugins/actions.d/
+    sudo install -m 644 "$vendor/config/snapper.actions" /etc/dnf/libdnf5-plugins/actions.d/
+
+    info "Enabling snapper timers..."
+    sudo systemctl enable --now snapper-timeline.timer snapper-cleanup.timer
+
+    ok "Snapper + grub-btrfs installed. Every dnf transaction now gets a pre/post snapshot."
+    info "Try it:  snapper ls   |   snapper status 1..2   |   sudo snapper undochange 1..2"
 }