fix(prefix,apps): restore _ensure_cacerts; add 600s install timeout; expand DXVK log filter

prefix.sh: _ensure_cacerts was dropped in the user cleanup (commit 44a8d08) but apps.sh still calls it at line 103. Restored stamp-file-guarded cacerts installation using Proton's wine64 binary.

apps.sh: add timeout 600 (10 min) before proton run to prevent indefinite stall when a GUI installer fails to exit normally — the process is killed after the timeout and install_app continues.

apps.sh awk filter: extend to also collapse DXVK info:/warn: lines and GnuTLS/ProtonFixes messages that come from launchers self-starting after installation (e.g. GOG Galaxy starting up mid-install). These account for thousands of lines of noise in the install output.

Author: xaoscience

lib/apps.sh

@@ -91,10 +91,15 @@ install_app() {
             ;;
     esac
 
-    "$PROTON_DIR/proton" run "${run_cmd[@]}" 2>&1 \
+    # timeout prevents indefinite stall if a GUI installer fails to close.
+    timeout 600 "$PROTON_DIR/proton" run "${run_cmd[@]}" 2>&1 \
         | awk '/MonoBtlsPkcs12\.Import|Missing private key/ { c++; next }
+               /^info:  |^warn:  |^GnuTLS error:|^ProtonFixes\[/ { dxvk++; next }
                { print }
-               END { if (c+0>0) printf "[WARN] %d Mono TLS cert exceptions suppressed (run: wig init to install cacerts)\n", c }' \
+               END {
+                   if (c+0>0)    printf "[WARN] %d Mono TLS cert exceptions suppressed\n", c
+                   if (dxvk+0>0) printf "[note] %d DXVK/Proton diagnostic lines suppressed\n", dxvk
+               }' \
         | tee "$install_log" || true
 
     if find_app_exe "$app_key" >/dev/null 2>&1; then

lib/prefix.sh

@@ -84,6 +84,27 @@ _install_winetricks_verbs() {
     )
 }
 
+# Install CA root certs exactly once via winetricks; stamp prevents re-running.
+_ensure_cacerts() {
+    local _stamp="$WINEPREFIX/pfx/.wg-cacerts"
+    [ -f "$_stamp" ] && return 0
+    [ ! -d "$WINEPREFIX/pfx/drive_c/windows/system32" ] && return 0
+    command -v winetricks &>/dev/null || return 0
+    print_info "Installing CA certificates (first run — enables HTTPS in launchers)..."
+    local _wine_bin="wine" _wt_prefix="$WINEPREFIX/pfx" _c
+    for _c in "$PROTON_DIR/files/bin/wine64" "$PROTON_DIR/files/bin/wine"; do
+        [ -x "$_c" ] && { _wine_bin="$_c"; break; }
+    done
+    (
+        export WINE="$_wine_bin"
+        export WINESERVER="$(dirname "$_wine_bin")/wineserver"
+        export WINEPREFIX="$_wt_prefix"
+        [ -d "$PROTON_DIR/files/lib64" ] && \
+            export LD_LIBRARY_PATH="$PROTON_DIR/files/lib:$PROTON_DIR/files/lib64${LD_LIBRARY_PATH:+:$LD_LIBRARY_PATH}"
+        WINETRICKS_LATEST_VERSION_CHECK=disabled winetricks -q --force cacerts >/dev/null 2>&1
+    ) && touch "$_stamp" \
+      || print_warning "cacerts failed — HTTPS downloads may fail; run: wig init"
+}
 # Print the managed prefix paths and env-var exports for manual use.
 prefix_info() {
     echo "━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"