feat(arch-layer,scripts): linux-gated desktop configs + package install scripts

niri (exact_config.d, scripts), noctalia (plugins excluded — runtime
state with embedded token), fontconfig, mimeapps.list,
niri-dynamic-workspaces, systemd user unit files (enable-state not
managed; only nirinit enabled by run_once), niri-launch vendored from
/usr/bin (unowned hand-written script, shellcheck warnings pre-existing).

Scripts: packages (pacman --needed + paru, brew on darwin, root-safe,
keyed on packages.yaml hash), gh extensions (idempotent), user services
(linux), post (tpm clone, bat cache, fc-cache). All shellcheck-clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.chezmoiscripts/run_once_after_30-user-services.sh.tmpl

@@ -0,0 +1,15 @@
+{{ if eq .chezmoi.os "linux" -}}
+#!/bin/sh
+# Enable session-critical user services. Personal automation units
+# (brain-lens, omp-loop, rclone, hermes, voxtype) ship as files only —
+# enable manually per machine. See MIGRATION-NOTES.md.
+set -eu
+
+if [ -f "$HOME/.config/systemd/user/nirinit.service" ] && command -v systemctl >/dev/null 2>&1; then
+    systemctl --user daemon-reload || true
+    systemctl --user enable nirinit.service || true
+fi
+{{ else -}}
+#!/bin/sh
+exit 0
+{{ end -}}

.chezmoiscripts/run_onchange_after_20-gh-extensions.sh.tmpl

@@ -0,0 +1,12 @@
+#!/bin/sh
+# Install gh extensions declared in .chezmoidata/packages.yaml.
+# gh_extensions hash: {{ .packages.shared.gh_extensions | toJson | sha256sum }}
+set -eu
+
+command -v gh >/dev/null 2>&1 || { echo "warning: gh not installed — skipping extensions" >&2; exit 0; }
+gh auth status >/dev/null 2>&1 || { echo "warning: gh not authenticated — run 'gh auth login', then 'chezmoi apply' again" >&2; exit 0; }
+
+installed=$(gh extension list 2>/dev/null | cut -f2 || true)
+{{ range .packages.shared.gh_extensions }}
+echo "$installed" | grep -qxF "{{ . }}" || gh extension install "{{ . }}"
+{{ end }}

.chezmoiscripts/run_onchange_after_40-post.sh.tmpl

@@ -0,0 +1,14 @@
+#!/bin/sh
+# Post-apply housekeeping. Re-runs when this file's rendered content changes.
+set -eu
+
+# tmux plugin manager — tmux.conf expects tpm at this path
+if command -v tmux >/dev/null 2>&1 && [ ! -d "$HOME/.config/tmux/plugins/tpm" ]; then
+    git clone --depth=1 https://github.com/tmux-plugins/tpm "$HOME/.config/tmux/plugins/tpm" || true
+fi
+
+if command -v bat >/dev/null 2>&1; then bat cache --build >/dev/null || true; fi
+
+{{ if eq .chezmoi.os "linux" -}}
+if command -v fc-cache >/dev/null 2>&1; then fc-cache -f >/dev/null || true; fi
+{{ end -}}

.chezmoiscripts/run_onchange_before_10-packages.sh.tmpl

@@ -0,0 +1,44 @@
+#!/bin/sh
+# Install packages declared in .chezmoidata/packages.yaml.
+# packages.yaml hash: {{ include ".chezmoidata/packages.yaml" | sha256sum }}
+set -eu
+
+{{ if eq .chezmoi.os "linux" -}}
+if [ "$(id -u)" -eq 0 ]; then PACMAN="pacman"; else PACMAN="sudo pacman"; fi
+
+# shellcheck disable=SC2086  # word splitting intended
+$PACMAN -S --needed --noconfirm \
+{{ range .packages.arch.pacman }}    {{ . }} \
+{{ end }}    && true
+
+{{ if or (eq .role "desktop") (eq .role "laptop") -}}
+$PACMAN -S --needed --noconfirm \
+{{ range .packages.arch.desktop.pacman }}    {{ . }} \
+{{ end }}    && true
+
+aur_pkgs="{{ range .packages.arch.desktop.aur }}{{ . }} {{ end }}{{ range .packages.arch.aur }}{{ . }} {{ end }}"
+{{ else -}}
+aur_pkgs="{{ range .packages.arch.aur }}{{ . }} {{ end }}"
+{{ end -}}
+if [ -n "$(echo "$aur_pkgs" | tr -d ' ')" ]; then
+    if command -v paru >/dev/null 2>&1; then
+        # shellcheck disable=SC2086
+        paru -S --needed --noconfirm $aur_pkgs
+    else
+        echo "warning: paru not found — skipping AUR packages: $aur_pkgs" >&2
+    fi
+fi
+
+{{ else if eq .chezmoi.os "darwin" -}}
+if ! command -v brew >/dev/null 2>&1; then
+    echo "error: homebrew not installed — https://brew.sh" >&2
+    exit 1
+fi
+brew install \
+{{ range .packages.darwin.brew }}    {{ . }} \
+{{ end }}    && true
+
+brew install --cask \
+{{ range .packages.darwin.cask }}    {{ . }} \
+{{ end }}    && true
+{{ end -}}