fix: close the four known installer bugs (DU-H1, DU-H2, BUG-1, BUG-2)

- DU-H1: flags are parsed wherever they sit, so `install --unattended`
  and `--unattended install` are the same run; any unknown flag, word,
  or subcommand exits 2 to stderr before a package manager is touched.
- DU-H2: every download lands in one private mktemp -d (mode 700)
  workdir per run, is checked non-empty before sudo tar sees it, and an
  EXIT/INT/TERM trap cleans up. No fixed /tmp paths remain.
- BUG-1: ^t is now toggle-shown — it ticks only the rows the active
  filter is showing, and @needs expansion stops at the first invasive
  row, so an invasive package can never be ticked off-screen.
- BUG-2: ^t journals what it added, so a second ^t over the same shown
  set unticks exactly that set; the bind no longer clears the query.
- lab: the type verb polls fzf's reported query to a deadline instead
  of a fixed sleep; marks_settled retries within its deadline.

Suite 256/0 host, 214/0 docker (ubuntu:24.04), mutations 24/24 killed
(six new mutants re-introduce each bug and all die), lab 6/6 green.

.tests/fakebin/_curl

@@ -20,6 +20,14 @@ done
 cfg=
 [ "$readcfg" = 1 ] && cfg=$(cat)          # always drain: the writer is a pipe
 
+# Where a download lands is itself under test (DU-H2: the tarballs used to go to
+# /tmp/nvim.tgz and be unpacked by `sudo tar`). The directory is private to the
+# run and removed before it exits, so its mode can only be observed from in
+# here. Recorded beside the argv line _fake has already written.
+[ -n "$out" ] && printf 'curl-outdir %s %s\n' "$(dirname "$out")" \
+	"$(stat -c %a "$(dirname "$out")" 2>/dev/null || echo unknown)" \
+	>> "${DOTUP_TEST_LOG:?DOTUP_TEST_LOG unset}"
+
 emit() { if [ -n "$out" ]; then cat > "$out"; else cat; fi; }
 
 # A tiny installer script, printed the way get.chezmoi.io and astral.sh print