full read: fix the set -e footguns a full run would have hit

Read the whole thing — 2392 lines of entry point and 2700 of libraries — looking
for what shellcheck cannot see. shellcheck itself is clean at error level; its
warnings are cross-file false positives and one deliberate tilde in a display
string. Everything below is a real defect.

── The Git section aborted on any machine where git was not already configured ──

`git config --global --get <key>` exits NON-ZERO when the key is simply unset,
and `VAR="$(git_get …)"` propagates that under `set -e`. So on a fresh machine —
the case this script exists for — the section died at its first assignment,
before printing anything, and took the remaining nine sections with it.

It passed every earlier test because those harnesses sourced the section under a
`bash -c` with no `set -e`. Verified now against a genuinely fresh account with
the real script: the section completes and writes a correct .gitconfig.

── An optional step failing aborted the whole run ──

Twelve functions ended on a command that can fail — `systemctl enable --now
earlyoom`, `systemctl restart systemd-logind`, `chsh`, `sysctl -w`, `chown -R`,
the oh-my-zsh installer, and others. Called as plain commands under `set -e`, any
one of them failing ends the script, so a masked unit or a container without
systemd would abort a 28-section run over an optional improvement.

They now return 0 explicitly and the callers verify the outcome instead — which
also fixed a lie: the sleep section printed "sleep disabled, logind reloaded"
whether or not the restart had worked. It now checks the targets and the logind
values and reports honestly.

── chown user:user assumed the primary group is named after the user ──

True on Debian and Ubuntu, which create a group per user. Not true for an account
from LDAP, or made with `useradd -g users`, or on an image with a shared group —
there `install -g <user>` fails with "invalid group" and the step aborts. Proved
it against an account whose primary group is `oddgroup`: the old form fails, the
new one gets ownership right. Eight call sites now ask `id -gn`.

── Also hardened ──

agent_path and current_editor gained `|| true` for the same reason git_get needed
it: "nothing is set" is an answer, not a failure.

Verified afterwards: shellcheck clean at error level, every section runs
standalone without aborting, and the two apparent failures in that sweep are
correct behaviour — Timezone and Git refusing an empty answer from /dev/null.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/setup/machine-setup/lib/system.sh

@@ -171,6 +171,11 @@ swap_create() {
 swappiness_set() {
   echo "vm.swappiness=$1" >/etc/sysctl.d/99-machine-setup-swappiness.conf
   sysctl -q -w "vm.swappiness=$1"
+  # Returns 0 whatever happens. This is an optional improvement, and a
+  # function that ends on a failing command is fatal under `set -e` when it
+  # is called as a plain command — which would abort the remaining sections
+  # over something the run could simply report. The caller checks the outcome.
+  return 0
 }
 
 # -----------------------------------------------------------------------------
@@ -322,6 +327,11 @@ earlyoom_is_active() { systemctl is-active --quiet earlyoom 2>/dev/null; }
 earlyoom_install() {
   pkg_is_installed earlyoom || pkg_install_now earlyoom
   systemctl enable --now earlyoom >/dev/null 2>&1
+  # Returns 0 whatever happens. This is an optional improvement, and a
+  # function that ends on a failing command is fatal under `set -e` when it
+  # is called as a plain command — which would abort the remaining sections
+  # over something the run could simply report. The caller checks the outcome.
+  return 0
 }
 
 # -----------------------------------------------------------------------------
@@ -353,6 +363,11 @@ fs.inotify.max_user_instances=${INOTIFY_INSTANCES}
 EOF
   sysctl -q -w "fs.inotify.max_user_watches=${INOTIFY_WATCHES}"
   sysctl -q -w "fs.inotify.max_user_instances=${INOTIFY_INSTANCES}"
+  # Returns 0 whatever happens. This is an optional improvement, and a
+  # function that ends on a failing command is fatal under `set -e` when it
+  # is called as a plain command — which would abort the remaining sections
+  # over something the run could simply report. The caller checks the outcome.
+  return 0
 }
 
 # -----------------------------------------------------------------------------
@@ -436,6 +451,11 @@ disable_sleep() {
   # Only restart when something actually changed — a needless restart of logind
   # disturbs live sessions, and this step runs on every pass.
   systemctl restart systemd-logind
+  # Returns 0 whatever happens. This is an optional improvement, and a
+  # function that ends on a failing command is fatal under `set -e` when it
+  # is called as a plain command — which would abort the remaining sections
+  # over something the run could simply report. The caller checks the outcome.
+  return 0
 }
 
 # -----------------------------------------------------------------------------
@@ -482,7 +502,12 @@ wait_online_boot_time() {
   systemd-analyze blame 2>/dev/null | awk -v u="$WAIT_ONLINE_UNIT" '$NF == u { $NF = ""; sub(/[[:space:]]+$/, ""); print; exit }'
 }
 
-mask_wait_online() { systemctl mask --now "$WAIT_ONLINE_UNIT" >/dev/null 2>&1; }
+# Returns 0 whatever happens — see swappiness_set for why an optional step must
+# not be able to abort the run.
+mask_wait_online() {
+  systemctl mask --now "$WAIT_ONLINE_UNIT" >/dev/null 2>&1
+  return 0
+}
 
 # -----------------------------------------------------------------------------
 # Timezone