full read: fix the set -e footguns a full run would have hit

Read the whole thing — 2392 lines of entry point and 2700 of libraries — looking
for what shellcheck cannot see. shellcheck itself is clean at error level; its
warnings are cross-file false positives and one deliberate tilde in a display
string. Everything below is a real defect.

── The Git section aborted on any machine where git was not already configured ──

`git config --global --get <key>` exits NON-ZERO when the key is simply unset,
and `VAR="$(git_get …)"` propagates that under `set -e`. So on a fresh machine —
the case this script exists for — the section died at its first assignment,
before printing anything, and took the remaining nine sections with it.

It passed every earlier test because those harnesses sourced the section under a
`bash -c` with no `set -e`. Verified now against a genuinely fresh account with
the real script: the section completes and writes a correct .gitconfig.

── An optional step failing aborted the whole run ──

Twelve functions ended on a command that can fail — `systemctl enable --now
earlyoom`, `systemctl restart systemd-logind`, `chsh`, `sysctl -w`, `chown -R`,
the oh-my-zsh installer, and others. Called as plain commands under `set -e`, any
one of them failing ends the script, so a masked unit or a container without
systemd would abort a 28-section run over an optional improvement.

They now return 0 explicitly and the callers verify the outcome instead — which
also fixed a lie: the sleep section printed "sleep disabled, logind reloaded"
whether or not the restart had worked. It now checks the targets and the logind
values and reports honestly.

── chown user:user assumed the primary group is named after the user ──

True on Debian and Ubuntu, which create a group per user. Not true for an account
from LDAP, or made with `useradd -g users`, or on an image with a shared group —
there `install -g <user>` fails with "invalid group" and the step aborts. Proved
it against an account whose primary group is `oddgroup`: the old form fails, the
new one gets ownership right. Eight call sites now ask `id -gn`.

── Also hardened ──

agent_path and current_editor gained `|| true` for the same reason git_get needed
it: "nothing is set" is an answer, not a failure.

Verified afterwards: shellcheck clean at error level, every section runs
standalone without aborting, and the two apparent failures in that sweep are
correct behaviour — Timezone and Git refusing an empty answer from /dev/null.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/setup/machine-setup/machine-setup.sh

@@ -764,7 +764,7 @@ if ! skip; then
     echo "     already has ${ACTIVE_SWAP_GB}G of swap, leaving it alone"
     if [[ "$CURRENT_SWAPPINESS" != "$SWAPPINESS" ]] && confirm "Set swappiness to ${SWAPPINESS}?"; then
       swappiness_set "$SWAPPINESS"
-      ok "swappiness set to ${SWAPPINESS}"
+      ok "swappiness is now $(sysctl -n vm.swappiness)"
       SUMMARY+=("Swap: kept ${ACTIVE_SWAP_GB}G, swappiness ${SWAPPINESS}")
     else
       SUMMARY+=("Swap: kept ${ACTIVE_SWAP_GB}G")
@@ -778,7 +778,7 @@ if ! skip; then
     if confirm "Proceed?"; then
       swap_create "$WANT_SWAP_GB"
       swappiness_set "$SWAPPINESS"
-      ok "${WANT_SWAP_GB}G swap active, swappiness ${SWAPPINESS}"
+      ok "$(swap_active_gb)G swap active, swappiness $(sysctl -n vm.swappiness)"
       SUMMARY+=("Swap: ${WANT_SWAP_GB}G created, swappiness ${SWAPPINESS}")
     else
       warn "skipped by request"
@@ -1044,8 +1044,17 @@ elif ! skip; then
     echo "     clean shutdown is 'sudo poweroff' rather than the button."
     if confirm "Proceed?"; then
       disable_sleep
-      ok "sleep disabled, logind reloaded"
-      SUMMARY+=("Sleep: disabled (targets masked, logind handlers ignored)")
+      # Verified rather than asserted: disable_sleep returns 0 whatever happens,
+      # so that a failed logind restart cannot abort the remaining sections. The
+      # check is what turns that into an honest report.
+      if sleep_targets_masked && logind_is_configured; then
+        ok "sleep disabled, logind reloaded"
+        SUMMARY+=("Sleep: disabled (targets masked, logind handlers ignored)")
+      else
+        warn "sleep settings were written but are not all in force — check: systemctl status systemd-logind"
+        ERRORS+=("Sleep: settings written but not in force")
+        SUMMARY+=("Sleep: written, NOT fully in force")
+      fi
     else
       warn "skipped by request"
       SUMMARY+=("Sleep: SKIPPED by request")
@@ -2141,7 +2150,7 @@ if ! skip; then
     # unguarded, so a re-run duplicated the lot.
     ZSHRC="${USER_HOME}/.zshrc"
     touch "$ZSHRC"
-    chown "$USERNAME:$USERNAME" "$ZSHRC"
+    chown "${USERNAME}:$(user_group)" "$ZSHRC"
 
     if command -v starship &>/dev/null; then
       if append_once "$ZSHRC" starship <<'EOF'