scripts: make setup.sh converge instead of trusting proxies

Two guards that checked something other than the state they were protecting.

Section 17 skipped the entire remote desktop setup when `dpkg -s ubuntu-desktop`
succeeded, treating one package being present as proof that seven steps of
configuration had run. A host can have ubuntu-desktop and still be missing GDM
auto-login, the forced Xorg session, the captured EDID and its kernel command
line, and the login-time mode setter — which is exactly what this machine was
on 2026-08-02, while the guard cheerfully reported "skip". setup-desktop.sh is
idempotent throughout, so the guard bought nothing and cost a converged host.

The starship step had the opposite bug: it cp'd over ~/.config/starship.toml on
every run, so a customised config was silently destroyed. The nvim step two
sections down already guards on its config's existence; this now matches, and
distinguishes "absent" (deploy) from "identical" (skip) from "yours differs"
(keep, and say how to take ours).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/setup.sh

@@ -614,10 +614,20 @@ else
   if has starship; then ok "starship installed"; else warn "starship install failed"; fi
 fi
 
-# Deploy starship config
+# Deploy starship config. Unconditionally cp'ing here overwrote a customised ~/.config/starship.toml on
+# every run, silently — the nvim step below already gets this right by guarding on the config's
+# existence, so this was just inconsistent. Converge when there is nothing to lose, keep what the user
+# wrote when there is.
 mkdir -p "$HOME/.config"
-cp "$SCRIPT_DIR/starship.toml" "$HOME/.config/starship.toml"
+STARSHIP_DEST="$HOME/.config/starship.toml"
+if [ ! -f "$STARSHIP_DEST" ]; then
+  cp "$SCRIPT_DIR/starship.toml" "$STARSHIP_DEST"
   ok "starship config deployed"
+elif cmp -s "$SCRIPT_DIR/starship.toml" "$STARSHIP_DEST"; then
+  skip "starship config (already current)"
+else
+  skip "starship config (yours differs — kept; cp scripts/starship.toml ~/.config/ to take this one)"
+fi
 
 # Oh-My-Zsh
 if [ -d "$HOME/.oh-my-zsh" ]; then
@@ -866,9 +876,15 @@ fi
 echo ""
 echo "── Remote Desktop (Ubuntu Desktop + VNC) ──"
 
-if dpkg -s ubuntu-desktop &>/dev/null 2>&1; then
-  skip "remote desktop (ubuntu-desktop already installed)"
-else
+# No "already installed" guard here on purpose. This used to skip on `dpkg -s ubuntu-desktop`, which
+# treats one package being present as proof the whole remote desktop is configured — and those are very
+# different things. A host can have ubuntu-desktop and still be missing every part that makes the mirror
+# work: GDM auto-login, the forced Xorg session, the captured EDID and its kernel command line, the
+# login-time mode setter. That was not hypothetical; it was this machine on 2026-08-02, where the guard
+# reported "skip" while five of setup-desktop.sh's steps had never run and /desktop could not survive a
+# reboot. setup-desktop.sh is idempotent throughout — every step either no-ops or is individually
+# guarded — so letting it run each time converges a partially configured host instead of trusting a
+# proxy for state it never actually checked.
 case $PM in
   apt)
     bash "$SCRIPT_DIR/setup-desktop.sh"
@@ -877,7 +893,6 @@ else
     warn "Remote desktop setup is Ubuntu/Debian only — skipping"
     ;;
 esac
-fi
 
 # ─── 18. project initialization ──────────────────────────────────────────────
 echo ""