Advanced-menu installs go quiet: fix stdin theft + silent wiring

YuKu on the VM: menu installs were not quiet — the ONE place dnf's
full output still scrolled.

Root cause: the per-item install loop read picks with
'while read ... <<< "$sel"' — a herestring REPLACES stdin for its
whole body, so ui_quiet_run's tty gate saw 'piped' inside the loop
and every menu install ran in plain mode. Picks are now read into an
array first (herestring fills ONLY that); installs run in a for-loop
that never touches stdin.

Also silenced the remaining raw output in the menu path:
- Chrome repo wiring -> install_optional (quiet) + setopt silenced,
  direct-rpm fallback via ui_quiet_run
- Brave addrepo -> ui_quiet_run
- flatpak installs -> ui_quiet_run; ui_quiet_run now also matches
  flatpak's 'Installing...' progress (Unicode ellipsis) for the live
  line and count, sanitized to printable ASCII (tr -cd) so a
  non-UTF8 console never sees garbage bytes.

Pty-verified: live block lines + green summaries for chrome/gimp/
vscodium picks, flatpak progress only in the log, zero raw dnf or
flatpak text on screen.

setup.sh

@@ -494,9 +494,18 @@ run_advanced_menu() {
         # transaction (VM: brave's no-match took chromium down with it).
         # Repo wiring inside install_category_pkgs runs per item; failures
         # warn in red and the remaining picks still install.
-        local picked lbl it
+        # Read the picks into an ARRAY first, install in a for-loop.
+        # A `while read ... <<< "$sel"` herestring REPLACES stdin for its whole
+        # body — inside it stdin is no longer a TTY, ui_quiet_run saw "piped"
+        # and menu installs ran in plain mode (VM-proven: the advanced menu
+        # was the one place dnf's full output still scrolled).
+        local -a picked_items=()
         while IFS= read -r picked; do
-            [[ -z "$picked" ]] && continue
+            [[ -n "$picked" ]] && picked_items+=("$picked")
+        done <<< "$sel"
+
+        local picked lbl it
+        for picked in "${picked_items[@]}"; do
             for entry in "${entries[@]}"; do
                 rest="${entry#*:}"
                 lbl="${rest%%:*}"
@@ -516,7 +525,7 @@ run_advanced_menu() {
                     pause_if_debug
                 fi
             done
-        done <<< "$sel"
+        done
     done
     # not `&& ok` — a false done_any would return 1 and kill the script under set -e
     if [[ "$done_any" == "true" ]]; then
@@ -547,8 +556,10 @@ install_category_pkgs() {
         install_category_pkgs_dnf "$cat" "${dp[@]}" || return 1
     fi
     if (( ${#fp[@]} > 0 )); then
-        info "Installing flatpaks from Flathub: ${fp[*]}"
-        flatpak install -y flathub "${fp[@]}" || return 1
+        # quiet like dnf: live block line, full output in the log, red + tail
+        # on failure (ui_quiet_run matches flatpak's 'Installing...' lines)
+        ui_quiet_run "Installing flatpak: ${fp[*]}" \
+            flatpak install -y flathub "${fp[@]}" || return 1
     fi
     return 0
 }
@@ -579,9 +590,12 @@ install_category_pkgs_dnf() {
             done
             if $needs_chrome && ! pkg_installed google-chrome-stable; then
                 info "Adding Google Chrome repo..."
-                sudo dnf install -y fedora-workstation-repositories 2>/dev/null || true
-                sudo dnf config-manager setopt google-chrome.enabled=1 2>/dev/null || \
-                    sudo dnf install -y "https://dl.google.com/linux/direct/google-chrome-stable_current_x86_64.rpm"
+                install_optional fedora-workstation-repositories
+                if ! sudo dnf config-manager setopt google-chrome.enabled=1 >/dev/null 2>&1; then
+                    # repo enable failed: install straight from Google's rpm
+                    ui_quiet_run "Installing Google Chrome (direct rpm)" \
+                        sudo dnf install -y "https://dl.google.com/linux/direct/google-chrome-stable_current_x86_64.rpm"
+                fi
             fi
             if $needs_brave && ! pkg_installed brave-browser; then
                 # dnf5 (Fedora 41+) has no 'config-manager add' subcommand —
@@ -592,8 +606,8 @@ install_category_pkgs_dnf() {
                 if [[ -f /etc/yum.repos.d/brave-browser.repo ]]; then
                     ok "Brave repo already present."
                 else
-                    info "Adding Brave repo (dnf5 addrepo)..."
-                    sudo dnf config-manager addrepo \
+                    ui_quiet_run "Adding Brave repo (dnf5 addrepo)" \
+                        sudo dnf config-manager addrepo \
                         --from-repofile=https://brave-browser-rpm-release.s3.brave.com/brave-browser.repo
                 fi
             fi