Advanced-menu installs go quiet: fix stdin theft + silent wiring

YuKu on the VM: menu installs were not quiet — the ONE place dnf's
full output still scrolled.

Root cause: the per-item install loop read picks with
'while read ... <<< "$sel"' — a herestring REPLACES stdin for its
whole body, so ui_quiet_run's tty gate saw 'piped' inside the loop
and every menu install ran in plain mode. Picks are now read into an
array first (herestring fills ONLY that); installs run in a for-loop
that never touches stdin.

Also silenced the remaining raw output in the menu path:
- Chrome repo wiring -> install_optional (quiet) + setopt silenced,
  direct-rpm fallback via ui_quiet_run
- Brave addrepo -> ui_quiet_run
- flatpak installs -> ui_quiet_run; ui_quiet_run now also matches
  flatpak's 'Installing...' progress (Unicode ellipsis) for the live
  line and count, sanitized to printable ASCII (tr -cd) so a
  non-UTF8 console never sees garbage bytes.

Pty-verified: live block lines + green summaries for chrome/gimp/
vscodium picks, flatpak progress only in the log, zero raw dnf or
flatpak text on screen.

lib/common.sh

@@ -140,9 +140,13 @@ ui_quiet_run() {
     local pid=$!
     local f=0 cur
     while kill -0 "$pid" 2>/dev/null; do
+        # Match dnf ('Installing: pkg') AND flatpak ('Installing... id', a
+        # Unicode ellipsis) progress lines; sanitize to printable ASCII so a
+        # non-UTF8 console never sees garbage bytes in the live line.
         cur=$(sed -n "$((before+1)),\$p" "$log" 2>/dev/null \
-                | grep -E '^(Installing|Upgrading|Downgrading|Removing|Verifying|Preparing|Cleanup):' \
-                | tail -n 1 || true)
+                | grep -aE '^Installing|^Upgrading|^Downgrading|^Removing|^Verifying|^Preparing|^Cleanup' \
+                | tail -n 1 \
+                | tr -cd '\11\12\40-\176' || true)
         # Compose ONCE, then clamp to the terminal width: a live line longer
         # than the screen wraps on every redraw and floods the screen with
         # duplicate partial lines (VM-proven on the 80-col TTY).
@@ -172,7 +176,7 @@ ui_quiet_run() {
     printf '\r%*s\r' 100 '' >&2
 
     if (( rc == 0 )); then
-        n=$(sed -n "$((before+1)),\$p" "$log" 2>/dev/null | grep -c '^Installing:' || true)
+        n=$(sed -n "$((before+1)),\$p" "$log" 2>/dev/null | grep -ac '^Installing' || true)
         local plural="s"
         (( n == 1 )) && plural=""
         if (( depth == 256 )); then

setup.sh

@@ -494,9 +494,18 @@ run_advanced_menu() {
         # transaction (VM: brave's no-match took chromium down with it).
         # Repo wiring inside install_category_pkgs runs per item; failures
         # warn in red and the remaining picks still install.
-        local picked lbl it
+        # Read the picks into an ARRAY first, install in a for-loop.
+        # A `while read ... <<< "$sel"` herestring REPLACES stdin for its whole
+        # body — inside it stdin is no longer a TTY, ui_quiet_run saw "piped"
+        # and menu installs ran in plain mode (VM-proven: the advanced menu
+        # was the one place dnf's full output still scrolled).
+        local -a picked_items=()
         while IFS= read -r picked; do
-            [[ -z "$picked" ]] && continue
+            [[ -n "$picked" ]] && picked_items+=("$picked")
+        done <<< "$sel"
+
+        local picked lbl it
+        for picked in "${picked_items[@]}"; do
             for entry in "${entries[@]}"; do
                 rest="${entry#*:}"
                 lbl="${rest%%:*}"
@@ -516,7 +525,7 @@ run_advanced_menu() {
                     pause_if_debug
                 fi
             done
-        done <<< "$sel"
+        done
     done
     # not `&& ok` — a false done_any would return 1 and kill the script under set -e
     if [[ "$done_any" == "true" ]]; then
@@ -547,7 +556,9 @@ install_category_pkgs() {
         install_category_pkgs_dnf "$cat" "${dp[@]}" || return 1
     fi
     if (( ${#fp[@]} > 0 )); then
-        info "Installing flatpaks from Flathub: ${fp[*]}"
+        # quiet like dnf: live block line, full output in the log, red + tail
+        # on failure (ui_quiet_run matches flatpak's 'Installing...' lines)
+        ui_quiet_run "Installing flatpak: ${fp[*]}" \
             flatpak install -y flathub "${fp[@]}" || return 1
     fi
     return 0
@@ -579,10 +590,13 @@ install_category_pkgs_dnf() {
             done
             if $needs_chrome && ! pkg_installed google-chrome-stable; then
                 info "Adding Google Chrome repo..."
-                sudo dnf install -y fedora-workstation-repositories 2>/dev/null || true
-                sudo dnf config-manager setopt google-chrome.enabled=1 2>/dev/null || \
+                install_optional fedora-workstation-repositories
+                if ! sudo dnf config-manager setopt google-chrome.enabled=1 >/dev/null 2>&1; then
+                    # repo enable failed: install straight from Google's rpm
+                    ui_quiet_run "Installing Google Chrome (direct rpm)" \
                         sudo dnf install -y "https://dl.google.com/linux/direct/google-chrome-stable_current_x86_64.rpm"
                 fi
+            fi
             if $needs_brave && ! pkg_installed brave-browser; then
                 # dnf5 (Fedora 41+) has no 'config-manager add' subcommand —
                 # the VM showed 'Unknown argument "add"', so the repo never
@@ -592,7 +606,7 @@ install_category_pkgs_dnf() {
                 if [[ -f /etc/yum.repos.d/brave-browser.repo ]]; then
                     ok "Brave repo already present."
                 else
-                    info "Adding Brave repo (dnf5 addrepo)..."
+                    ui_quiet_run "Adding Brave repo (dnf5 addrepo)" \
                         sudo dnf config-manager addrepo \
                         --from-repofile=https://brave-browser-rpm-release.s3.brave.com/brave-browser.repo
                 fi