fix(installer): make Arch installs work and stop the installer destroying data

[Albe841114]

Linked issues

Closes #183 — carapace is AUR-only, and pacman is atomic, so the whole install aborts
Closes #193 — rm -rf Gentleman.Dots on a CWD-relative path
Closes #195 — backup aborts when a directory contains a Unix socket

Partially addresses #190: the --dry-run no-op is fixed here. The Kitty selection point in that issue is not addressed.

Not fixed here, listed so the scope is unambiguous: #194 (E2E pipefail) and #196 (fish configuration overwritten). Both are real and reported, but neither is touched by this branch.

Summary

• Makes the installer complete on Arch/CachyOS, where it currently aborts at the shell install step.
• Stops the installer from deleting a directory it did not create, and from deleting one that holds unpublished Git work.
• Makes --dry-run actually dry, and lets the backup survive Unix sockets.

Why it currently fails on Arch

The shell step runs one atomic pacman -S that includes carapace. That package does not exist in core/extra — it is AUR-only, published as carapace-bin, which does not declare provides=carapace. Because a pacman transaction is atomic, one unresolvable name aborts the whole thing and nothing installs. zsh-theme-powerlevel10k has the same problem.

Changes

File	Change
installer/internal/tui/installer.go	AUR-only names removed from the Arch lists for fish, zsh and nushell (lines 720, 775, 831); clone deletion routed through a safety check instead of an unconditional rm -rf
installer/internal/system/repostate.go	New: classifies a directory before deletion and fails closed when the state cannot be determined
installer/internal/system/exec.go	CopyFile/CopyDir skip non-regular files (sockets, FIFOs, device nodes) instead of erroring out
installer/internal/system/dryrun.go	New: --dry-run gate, including the os.RemoveAll path that the Run/RunWithLogs gate did not cover
installer/internal/tui/arch_packages_source_test.go	New: regression guard that reads the real package-list literals in installer.go, so an AUR-only name cannot come back

What "safe to delete" means here

This part exists because the guard written earlier in this change destroyed this change's own commits during development.

A clean working tree is not sufficient proof that a checkout can be deleted. A clean checkout can hold local commits that exist on no remote: git status --porcelain is empty and the work is still unrecoverable. Committing the work made it more deletable, not less.

The guard now requires: working tree clean, no untracked files, no stashes, and HEAD reachable from a remote-tracking branch. A branch with no configured upstream is treated as unsafe. It never prompts — --non-interactive is documented as CI-friendly, so a refusal is a deterministic abort, and callers decide whether that is fatal.

Test plan

• go test ./... — system and tui packages pass
• go build — clean
• RED verified by hand per unit: the implementation was reverted to confirm each test actually fails without it. This caught a false test whose inline fixture could never fail; it was rewritten to read the real source literals, which is why arch_packages_source_test.go exists.
• Arch package names checked against the archlinux.org API rather than the local machine — CachyOS carries its own repositories and would have produced false positives.
• Installer run end to end on CachyOS: completes, with starship, zoxide, atuin, fzf and nvim installed.

Notes for review

• Branch name and commits follow the repository's conventions.
• No type:* label is set: this account has read-only permission here and cannot apply labels.
• openspec/changes/archive/2026-08-29-fix-arch-installer/ carries the proposal, design, tasks and verification report. Happy to drop those files if they are not wanted in-tree — the code changes stand on their own.