fix: unattended install on a never-chosen box seeds the defaults

A fresh VM running `dotup install --unattended` got an empty plan and a
silent 'done'. -f $SEL cannot detect this (load-time setup creates the
file); choice is $PICKED or a non-empty selection, and only a box with
neither gets the defaults. A cron re-run of a saved selection and an
accepted chose-none both keep their meaning.

.tests/test.sh

@@ -653,6 +653,19 @@ has  "install --unattended refuses invasive too"   "refusing invasive packages"
 hasnt "…so the daemon never reaches a package manager" "docker-ce"       "$log"
 hasnt "…nor does the listening ssh port"           "openssh-server"      "$log"
 has  "…and the safe package still installs"        "ripgrep"             "$log"
+# A box where no selection has EVER existed: `install --unattended` must mean
+# the defaults, not a silent empty plan. (Found live 2026-08-23: a fresh VM ran
+# it, printed "done", and installed nothing at all.) An EXISTING empty file is
+# the opposite case -- someone chose none -- and stays honoured.
+newbox; BOXPATH=$SEALSUDO; rm -f "$SB/.config/dotfiles/selected"
+out=$(box install --unattended 2>&1 | plain || true)
+log=$(cat "$LOG")
+has   "no state file ever -> unattended install seeds the defaults" "ripgrep" "$log"
+hasnt "…and the seeded defaults never include an invasive row"      "docker-ce" "$log"
+newbox; BOXPATH=$SEALSUDO; : > "$SB/.config/dotfiles/picked"
+out=$(box install --unattended 2>&1 | plain || true)
+is    "an accepted chose-none is a decision — nothing installs" ""       "$(grep -E ' (install|remove|upgrade) ' "$LOG" || true)"
+
 # --print is the flag whose absence is most expensive to discover afterwards.
 newbox; BOXPATH=$SEALSUDO; pick core/ripgrep
 out=$(box install --print 2>&1 | plain || true)

dot_local/bin/executable_dotup

@@ -930,6 +930,14 @@ install_bespoke() {
 }
 
 cmd_install() {
+	# A cron job re-running `--unattended install` gets its SAVED selection --
+	# that contract stands. But on a box where nothing was ever chosen,
+	# "install what was saved" meant an empty plan and a silent "done" that
+	# installed nothing (found live 2026-08-23, phase 5 VM). `-f "$SEL"`
+	# cannot carry this test: load-time setup creates the file empty. Choice
+	# is what $PICKED marks (an accepted picker) or a non-empty selection (a
+	# preset); only a box with neither gets the defaults.
+	[ "$UNATTENDED" -ne 1 ] || [ -f "$PICKED" ] || [ -s "$SEL" ] || cmd_preset defaults
 	: > "$FAILED"
 	tbl=$STATE/.plan.$$
 	plan_table > "$tbl"