SilentSDDM theme, workstation-repos, Editors/Graphics/DevTools menus, flatpak support

Ported from the old fedora-full script:

- SilentSDDM SDDM theme in the tailoring section, gated on sddm
  being installed (skipped on gdm setups), idempotent via the
  ~/git/SilentSDDM checkout (pull --rebase when present), pipefail
  suspended around 'yes | ./install.sh' for the SIGPIPE trap.
- fedora-workstation-repositories added in base alongside the other
  repos (it ships the google-chrome repo the Browsers option enables).
- Advanced menu: Editors (VSCodium flatpak), Graphics and Multimedia
  (gimp/inkscape/obs/lollypop via dnf, spotify via flatpak), Development
  Tools (single option: @development-tools wget cmake ninja-build
  pkgconf-pkg-config). All names verified on F44.
- install_category_pkgs splits flatpak:<id> entries to Flathub so mixed
  picks cannot fail each other's transactions.

Harness: sddm->theme installs, gnome->skipped, vscodium+spotify via
flatpak, lollypop via dnf in the same multi-pick, devtools as one
transaction, all five categories listed, unattended+piped green.

setup.sh

@@ -192,6 +192,9 @@ add_rpmfusion_repo
 # Terra up front: it carries mangowc (noctalia moved into Fedora proper in
 # F44). Idempotent; also kept for the standalone-mango-module case.
 add_terra_repo
+# Fedora's third-party repo set (ships the google-chrome repo, disabled by
+# default — the Browsers menu option enables it via config-manager setopt).
+install_optional fedora-workstation-repositories
 pause_if_debug
 
 if ! command -v flatpak >/dev/null 2>&1; then
@@ -421,6 +424,9 @@ pause_if_debug
 ADV_CATEGORIES=(
     "Virtualisation"
     "Browsers"
+    "Editors"
+    "Graphics and Multimedia"
+    "Development Tools"
 )
 # shellcheck disable=SC2034  # arrays are read via nameref from ADV_CATEGORIES
 ADV_Virtualisation=(
@@ -434,6 +440,22 @@ ADV_Browsers=(
     "google-chrome:Google Chrome (adds repo):google-chrome-stable"
     "brave:Brave (adds repo):brave-browser"
 )
+# shellcheck disable=SC2034  # arrays are read via nameref from ADV_CATEGORIES
+ADV_Editors=(
+    "vscodium:VSCodium (flatpak):flatpak:com.vscodium.codium"
+)
+# shellcheck disable=SC2034
+ADV_Graphics_and_Multimedia=(
+    "gimp:GIMP:gimp"
+    "inkscape:Inkscape:inkscape"
+    "obs:OBS Studio:obs-studio"
+    "lollypop:Lollypop (music):lollypop"
+    "spotify:Spotify (flatpak):flatpak:com.spotify.Client"
+)
+# shellcheck disable=SC2034
+ADV_Development_Tools=(
+    "devtools:Development Tools (dnf group + build tools):@development-tools wget cmake ninja-build pkgconf-pkg-config"
+)
 
 run_advanced_menu() {
     local done_any=false
@@ -506,6 +528,33 @@ run_advanced_menu() {
 # app that needs one; packages alone stay generic.
 install_category_pkgs() {
     local cat="$1"; shift
+
+    # flatpak:<id> entries install from Flathub; the rest go to dnf. Split so
+    # a flatpak in a mixed pick cannot fail the dnf transaction (and vice
+    # versa — same per-item resilience as the rest of the menu).
+    local -a fp=() dp=()
+    local item
+    for item in "$@"; do
+        if [[ "$item" == flatpak:* ]]; then
+            fp+=("${item#flatpak:}")
+        else
+            dp+=("$item")
+        fi
+    done
+
+    if (( ${#dp[@]} > 0 )); then
+        # existing per-category wiring + dnf install (unchanged)
+        install_category_pkgs_dnf "$cat" "${dp[@]}" || return 1
+    fi
+    if (( ${#fp[@]} > 0 )); then
+        info "Installing flatpaks from Flathub: ${fp[*]}"
+        flatpak install -y flathub "${fp[@]}" || return 1
+    fi
+    return 0
+}
+
+install_category_pkgs_dnf() {
+    local cat="$1"; shift
     case "$cat" in
         Virtualisation)
             # qemu:///system without password prompts: libvirt group + enabled
@@ -652,6 +701,43 @@ fi
 systemctl --user enable pipewire pipewire-pulse wireplumber >/dev/null 2>&1 || true
 pause_if_debug
 
+# --- 8.5 SDDM theme (SilentSDDM) — only when SDDM is the greeter ---
+# Requires SDDM >= 0.21 (Fedora 44 ships 0.24+). Skipped on GNOME (gdm) and
+# any setup where sddm is not installed.
+if pkg_installed sddm; then
+    info "Installing SDDM theme: SilentSDDM..."
+    GIT_DIR="$HOME/git"
+    REPO_DIR="$GIT_DIR/SilentSDDM"
+    REPO_URL="https://github.com/uiriansan/SilentSDDM"
+
+    mkdir -p "$GIT_DIR"
+    if [[ -d "$REPO_DIR/.git" ]]; then
+        ok "SilentSDDM checkout exists. Updating..."
+        git -C "$REPO_DIR" pull --rebase --quiet || warn "git pull failed; using existing checkout."
+    else
+        info "Cloning SilentSDDM..."
+        git clone -b main --depth 1 --quiet "$REPO_URL" "$REPO_DIR" \
+            || { color_red "  Failed: git clone SilentSDDM (continuing)"; }
+    fi
+
+    if [[ -f "$REPO_DIR/install.sh" ]]; then
+        # yes | install.sh: the installer prompts; SIGPIPE from 'yes' would
+        # read as a crash under pipefail, so suspend it for this one command
+        set +o pipefail
+        if ( cd "$REPO_DIR" && yes | ./install.sh ); then
+            ok "SilentSDDM theme installed."
+        else
+            color_red "  Failed: SilentSDDM installer (continuing; SDDM keeps its default theme)"
+        fi
+        set -o pipefail
+    else
+        color_red "  SilentSDDM install.sh not found; skipping theme."
+    fi
+else
+    info "SDDM not installed (gdm/none setup) - skipping SDDM theme."
+fi
+pause_if_debug
+
 step "9 Summary"
 rule