fix: unattended install on a never-chosen box seeds the defaults

A fresh VM running `dotup install --unattended` got an empty plan and a
silent 'done'. -f $SEL cannot detect this (load-time setup creates the
file); choice is $PICKED or a non-empty selection, and only a box with
neither gets the defaults. A cron re-run of a saved selection and an
accepted chose-none both keep their meaning.

.tests/test.sh

@@ -653,6 +653,19 @@ has  "install --unattended refuses invasive too"   "refusing invasive packages"
 hasnt "…so the daemon never reaches a package manager" "docker-ce"       "$log"
 hasnt "…nor does the listening ssh port"           "openssh-server"      "$log"
 has  "…and the safe package still installs"        "ripgrep"             "$log"
+# A box where no selection has EVER existed: `install --unattended` must mean
+# the defaults, not a silent empty plan. (Found live 2026-08-23: a fresh VM ran
+# it, printed "done", and installed nothing at all.) An EXISTING empty file is
+# the opposite case -- someone chose none -- and stays honoured.
+newbox; BOXPATH=$SEALSUDO; rm -f "$SB/.config/dotfiles/selected"
+out=$(box install --unattended 2>&1 | plain || true)
+log=$(cat "$LOG")
+has   "no state file ever -> unattended install seeds the defaults" "ripgrep" "$log"
+hasnt "…and the seeded defaults never include an invasive row"      "docker-ce" "$log"
+newbox; BOXPATH=$SEALSUDO; : > "$SB/.config/dotfiles/picked"
+out=$(box install --unattended 2>&1 | plain || true)
+is    "an accepted chose-none is a decision — nothing installs" ""       "$(grep -E ' (install|remove|upgrade) ' "$LOG" || true)"
+
 # --print is the flag whose absence is most expensive to discover afterwards.
 newbox; BOXPATH=$SEALSUDO; pick core/ripgrep
 out=$(box install --print 2>&1 | plain || true)