Fix update discovery and isolate fingerprint installer permissions

plasma-fingerprint-workaround/tests/test-controller

@@ -29,4 +29,23 @@ source "$payload_config"
 [[ $payload_url == https://*/*.rpm ]]
 [[ $payload_sha256 =~ ^[[:xdigit:]]{64}$ ]]
 
+# Load the functions through the harmless help command, then replace DNF with
+# a test function. Never invoke the package manager in this test.
+(
+    source "$controller" --help >/dev/null
+    dnf5() {
+        [[ $(umask) == 0022 && $1 == test-argument ]]
+    }
+    umask 077
+    run_dnf test-argument
+    [[ $(umask) == 0077 ]]
+    dnf5() { return 23; }
+    if run_dnf test-argument; then
+        printf 'DNF failure was not propagated.\n' >&2
+        exit 1
+    else
+        [[ $? == 23 ]]
+    fi
+)
+
 printf 'Controller tests passed.\n'