list what the system update would actually upgrade

The section asked "Proceed?" without saying what it was proposing to change —
the one question in the script where the answer matters most, since it is the
only step that moves versions of software already on the machine.

pkg_upgradable now names them, from `apt-get upgrade -s`: the same calculation
the real run does, as opposed to `apt list --upgradable`, which also lists
packages held back that would not actually move.

Nothing to upgrade means no prompt at all, and the summary says so rather than
claiming an upgrade happened. The list is capped at 25 with a count of the rest,
because a box untouched for months lists hundreds and a wall of names is no more
informative than the number.

Verified against this host (0 upgradable, so it reports current and does not
ask) and with a stubbed 40-package list for the cap.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/setup/machine-setup/machine-setup.sh

@@ -87,17 +87,29 @@ if ! skip; then
   info "Refreshing the package index..."
   pkg_refresh >/dev/null
 
-  echo ""
-  info "System update — upgrades packages already installed to their latest versions"
-  echo "     this is the only step that changes software already on this machine"
+  mapfile -t UPGRADABLE < <(pkg_upgradable)
 
-  if confirm "Proceed?"; then
-    pkg_upgrade_all
-    ok "System upgraded"
-    SUMMARY+=("System packages upgraded")
+  echo ""
+  info "System update — the only step that changes software already on this machine"
+
+  if ((${#UPGRADABLE[@]} == 0)); then
+    echo "     to upgrade:   nothing, everything is current"
+    SUMMARY+=("System update: already up to date")
   else
-    warn "skipped by request"
-    SUMMARY+=("System update: SKIPPED by request")
+    echo "     to upgrade:   ${#UPGRADABLE[@]} package(s)"
+    # Capped, because a box that has not been touched in months lists hundreds
+    # and a wall of names is no more informative than a count.
+    printf '       %s\n' "${UPGRADABLE[@]:0:25}"
+    ((${#UPGRADABLE[@]} > 25)) && echo "       … and $((${#UPGRADABLE[@]} - 25)) more"
+
+    if confirm "Proceed?"; then
+      pkg_upgrade_all
+      ok "System upgraded"
+      SUMMARY+=("System upgraded: ${#UPGRADABLE[@]} package(s)")
+    else
+      warn "skipped by request"
+      SUMMARY+=("System update: SKIPPED by request — ${#UPGRADABLE[@]} package(s) left as they are")
+    fi
   fi
   step_ok
 fi