fix: guard success messages on command exit status

- Source x-path instead of capturing empty stdout via command substitution
- Validate --dry-run argument in cleanup script, reject unknown flags
- Gate success messages on preceding command's exit status with &&
- Applies to dfm (fmt, reset_nvim, shfmt) and install scripts
  (fonts, gh-extensions, python-packages, shellspec, z)

scripts/install-shellspec.sh

@@ -23,8 +23,8 @@ install_shellspec()
   fi
 
   msgr run "Running make install..."
-  make -C "$SHELLSPEC_CACHE" install PREFIX="$HOME/.local"
-  msgr run_done "shellspec $version installed to $HOME/.local/bin/shellspec"
+  make -C "$SHELLSPEC_CACHE" install PREFIX="$HOME/.local" \
+    && msgr run_done "shellspec $version installed to $HOME/.local/bin/shellspec"
   return 0
 }