port the locale section

Was three unconditional lines that ran on every pass and reported success either
way. Now it checks, says what it found, and asks.

The original tracked one fact where there are two:

  what a new login shell is told to use   LANG in /etc/default/locale
  whether that locale actually exists     whether it has been generated

Setting the first without the second is what produces "setlocale: LC_ALL: cannot
change locale" on every ssh login and every perl invocation. They fail
differently, so the step names whichever one is actually missing rather than
reporting a flat "locale not set".

Also fixes two things the original would have hit on a minimal image:

  locale-gen comes from the `locales` package, which cloud base images do not
  ship and which is not in core utils. It is installed on demand rather than
  assumed, instead of failing with "locale-gen: command not found".

  The locale is uncommented in /etc/locale.gen rather than only passed to
  locale-gen as an argument. A locale generated by argument alone disappears the
  next time anything regenerates from that file.

`locale -a` prints en_US.utf8 where the configuration spells it en_US.UTF-8, so
both sides are folded before comparing — a literal match reports a working locale
as missing.

LOCALE in the environment overrides the default. pacman, dnf and brew branches
are written but unreachable while the pre-flight gate is apt-only; macOS has no
system locale to set and says so.

Verified both paths on this host: en_US.UTF-8 reports already set and generated,
pt_PT.UTF-8 correctly reports both facts missing.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/setup/machine-setup/machine-setup.sh

@@ -22,6 +22,8 @@ source "$SCRIPT_DIR/lib/base.sh"
 source "$SCRIPT_DIR/lib/packages.sh"
 # shellcheck source=lib/tools.sh
 source "$SCRIPT_DIR/lib/tools.sh"
+# shellcheck source=lib/system.sh
+source "$SCRIPT_DIR/lib/system.sh"
 
 # Trap errors with context. Installed here rather than in lib/base.sh, because
 # that file is definitions only and a trap is a side effect on whoever sources it.
@@ -147,13 +149,51 @@ if ! skip; then
 fi
 
 
+# =============================================================================
+# 5. Locale
+# =============================================================================
+#
+# LOCALE in the environment overrides the default.
+
+step "Locale"
+if ! skip; then
+  LOCALE="${LOCALE:-en_US.UTF-8}"
+  CURRENT_LOCALE="$(locale_current)"
+
+  echo ""
+  info "Locale — the system language and character encoding"
+  echo "     current:      ${CURRENT_LOCALE:-none configured}"
+  echo "     to set:       ${LOCALE}"
+
+  if [[ "$CURRENT_LOCALE" == "$LOCALE" ]] && locale_is_generated "$LOCALE"; then
+    echo "     already set and generated, nothing to do"
+    SUMMARY+=("Locale: already ${LOCALE}")
+  else
+    # Say which of the two is actually wrong, since they fail differently: a
+    # missing LANG means the C locale, a missing generation means every login
+    # prints a setlocale warning.
+    [[ "$CURRENT_LOCALE" != "$LOCALE" ]] && echo "     LANG is not set to it"
+    locale_is_generated "$LOCALE" || echo "     the locale has not been generated on this machine"
+
+    if confirm "Proceed?"; then
+      locale_set "$LOCALE"
+      ok "Locale set to ${LOCALE}"
+      SUMMARY+=("Locale: ${LOCALE}")
+    else
+      warn "skipped by request"
+      SUMMARY+=("Locale: SKIPPED by request — left at ${CURRENT_LOCALE:-unset}")
+    fi
+  fi
+  step_ok
+fi
+
 # =============================================================================
 # NOT PORTED YET
 # =============================================================================
 #
 # Sections still to move across from scripts/setup-old/setup-ubuntu.sh, in order:
 #
-#   locale · timezone · swap · auto-suspend · boot-hang fix · user creation ·
+#   timezone · swap · auto-suspend · boot-hang fix · user creation ·
 #   ssh keys · ssh hardening · dns · static ip · fail2ban · unattended-upgrades ·
 #   git config · docker · zsh + prompt · tailscale · neovim · js runtimes ·
 #   dev tools · ufw · zshrc · disk ballast