fix: baseline role

roles/baseline/tasks/main.yaml

@@ -49,10 +49,11 @@
   - 'etc/modprobe.d/workstation-blacklist.conf'
   - 'etc/crypto-policies/back-ends/openssh.config'
 
-- name: Install sysctl
+- name: Install sysctl and flatpak
   ansible.builtin.dnf5:
     name:
       - 'procps-ng'
+      - 'flatpak'
     state: 'present'
 
 - name: Kernel sysctl config
@@ -137,7 +138,7 @@
     state: latest
 
 - name: Mark packages as manually installed to avoid removal
-  shell: 'dnf mark user flatpak gnome-menus qubes-menus -y'
+  shell: 'dnf mark user flatpak -y'
 
 - name: Enable hardened_malloc COPR
   shell: 'dnf copr enable secureblue/hardened_malloc -y'