feat(arch-layer,scripts): linux-gated desktop configs + package install scripts

niri (exact_config.d, scripts), noctalia (plugins excluded — runtime
state with embedded token), fontconfig, mimeapps.list,
niri-dynamic-workspaces, systemd user unit files (enable-state not
managed; only nirinit enabled by run_once), niri-launch vendored from
/usr/bin (unowned hand-written script, shellcheck warnings pre-existing).

Scripts: packages (pacman --needed + paru, brew on darwin, root-safe,
keyed on packages.yaml hash), gh extensions (idempotent), user services
(linux), post (tpm clone, bat cache, fc-cache). All shellcheck-clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.chezmoiscripts/run_onchange_after_20-gh-extensions.sh.tmpl

@@ -0,0 +1,12 @@
+#!/bin/sh
+# Install gh extensions declared in .chezmoidata/packages.yaml.
+# gh_extensions hash: {{ .packages.shared.gh_extensions | toJson | sha256sum }}
+set -eu
+
+command -v gh >/dev/null 2>&1 || { echo "warning: gh not installed — skipping extensions" >&2; exit 0; }
+gh auth status >/dev/null 2>&1 || { echo "warning: gh not authenticated — run 'gh auth login', then 'chezmoi apply' again" >&2; exit 0; }
+
+installed=$(gh extension list 2>/dev/null | cut -f2 || true)
+{{ range .packages.shared.gh_extensions }}
+echo "$installed" | grep -qxF "{{ . }}" || gh extension install "{{ . }}"
+{{ end }}