fix: guard success messages on command exit status

- Source x-path instead of capturing empty stdout via command substitution
- Validate --dry-run argument in cleanup script, reject unknown flags
- Gate success messages on preceding command's exit status with &&
- Applies to dfm (fmt, reset_nvim, shfmt) and install scripts
  (fonts, gh-extensions, python-packages, shellspec, z)

scripts/install-z.sh

@@ -15,8 +15,8 @@ clone_z_repo()
   local bin_path=$2
 
   if [[ ! -d "$bin_path" ]]; then
-    git clone "$git_path" "$bin_path"
-    msgr run_done "z installed at $bin_path"
+    git clone "$git_path" "$bin_path" \
+      && msgr run_done "z installed at $bin_path"
   else
     msgr ok "z ($bin_path/) already installed"
   fi