Advanced menu: fix single-argument dnf call; failures warn instead of aborting

Root cause of the VM failures (both qemu-kvm AND VirtualBox showed 'No
match for argument: <entire list>'): picks were resolved into ONE quoted
string and passed to dnf as a single argument, so dnf searched for a
package literally named 'qemu-kvm libvirt virt-install ...'. Picks are
now word-split into separate package arguments.

Also, a failing install no longer kills the script (set -e abort): the
menu prints a red 'Installation failed' warning, notes the system is
unchanged, and drops back to the menu so another choice can be made.
Proven in harness: VBox failure (no match) followed by successful qemu
install in the same session, exit 0.

setup.sh

@@ -503,14 +503,26 @@ run_advanced_menu() {
             if (( pick < 1 || pick > n )); then err "Ignoring out-of-range pick: $pick"; continue; fi
             entry="${entries[$((pick-1))]}"
             rest="${entry#*:}"; rest="${rest#*:}"         # drop id and label -> packages
-            to_install+=("$rest")
+            # word-split into SEPARATE packages: quoting $rest whole makes dnf
+            # look for one package named "qemu-kvm libvirt ..." (seen on the VM)
+            # shellcheck disable=SC2206
+            to_install+=(${rest})
         done
 
         if (( ${#to_install[@]} > 0 )); then
             step "Installing from $cat: ${to_install[*]}"
-            # Repos for items that need one are handled in install_optional_pkgs below.
-            install_category_pkgs "$cat" "${to_install[@]}"
-            done_any=true
+            # install_category_pkgs wires any needed third-party repo first.
+            # Failure must NOT kill the script: warn in red and drop back to
+            # the menu (set -e is bypassed for this one call).
+            if install_category_pkgs "$cat" "${to_install[@]}"; then
+                done_any=true
+            else
+                color_red "  Installation failed: ${to_install[*]}"
+                color_red "  (dnf reported no match / transaction failure — see output above)"
+                warn "  Returning to the menu. The system is unchanged."
+                pause_if_debug
+            fi
+            unset to_install; local -a to_install=()   # fresh slate for next pick
         fi
     done
     $done_any && ok "Optional tools installed."
@@ -542,7 +554,10 @@ install_category_pkgs() {
             fi
             ;;
     esac
-    install_packages "$@"
+    # Resilient install: report failure but return non-zero instead of
+    # aborting under set -e; the caller turns it into a red warning.
+    install_packages "$@" || return 1
+    return 0
 }
 
 # Interactive only: an unattended --yes run must not hang on this menu.