feat(arch-layer,scripts): linux-gated desktop configs + package install scripts

niri (exact_config.d, scripts), noctalia (plugins excluded — runtime
state with embedded token), fontconfig, mimeapps.list,
niri-dynamic-workspaces, systemd user unit files (enable-state not
managed; only nirinit enabled by run_once), niri-launch vendored from
/usr/bin (unowned hand-written script, shellcheck warnings pre-existing).

Scripts: packages (pacman --needed + paru, brew on darwin, root-safe,
keyed on packages.yaml hash), gh extensions (idempotent), user services
(linux), post (tpm clone, bat cache, fc-cache). All shellcheck-clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.chezmoiscripts/run_onchange_after_40-post.sh.tmpl

@@ -0,0 +1,14 @@
+#!/bin/sh
+# Post-apply housekeeping. Re-runs when this file's rendered content changes.
+set -eu
+
+# tmux plugin manager — tmux.conf expects tpm at this path
+if command -v tmux >/dev/null 2>&1 && [ ! -d "$HOME/.config/tmux/plugins/tpm" ]; then
+    git clone --depth=1 https://github.com/tmux-plugins/tpm "$HOME/.config/tmux/plugins/tpm" || true
+fi
+
+if command -v bat >/dev/null 2>&1; then bat cache --build >/dev/null || true; fi
+
+{{ if eq .chezmoi.os "linux" -}}
+if command -v fc-cache >/dev/null 2>&1; then fc-cache -f >/dev/null || true; fi
+{{ end -}}