feat(arch-layer,scripts): linux-gated desktop configs + package install scripts

niri (exact_config.d, scripts), noctalia (plugins excluded — runtime
state with embedded token), fontconfig, mimeapps.list,
niri-dynamic-workspaces, systemd user unit files (enable-state not
managed; only nirinit enabled by run_once), niri-launch vendored from
/usr/bin (unowned hand-written script, shellcheck warnings pre-existing).

Scripts: packages (pacman --needed + paru, brew on darwin, root-safe,
keyed on packages.yaml hash), gh extensions (idempotent), user services
(linux), post (tpm clone, bat cache, fc-cache). All shellcheck-clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.chezmoiscripts/run_onchange_before_10-packages.sh.tmpl

@@ -0,0 +1,44 @@
+#!/bin/sh
+# Install packages declared in .chezmoidata/packages.yaml.
+# packages.yaml hash: {{ include ".chezmoidata/packages.yaml" | sha256sum }}
+set -eu
+
+{{ if eq .chezmoi.os "linux" -}}
+if [ "$(id -u)" -eq 0 ]; then PACMAN="pacman"; else PACMAN="sudo pacman"; fi
+
+# shellcheck disable=SC2086  # word splitting intended
+$PACMAN -S --needed --noconfirm \
+{{ range .packages.arch.pacman }}    {{ . }} \
+{{ end }}    && true
+
+{{ if or (eq .role "desktop") (eq .role "laptop") -}}
+$PACMAN -S --needed --noconfirm \
+{{ range .packages.arch.desktop.pacman }}    {{ . }} \
+{{ end }}    && true
+
+aur_pkgs="{{ range .packages.arch.desktop.aur }}{{ . }} {{ end }}{{ range .packages.arch.aur }}{{ . }} {{ end }}"
+{{ else -}}
+aur_pkgs="{{ range .packages.arch.aur }}{{ . }} {{ end }}"
+{{ end -}}
+if [ -n "$(echo "$aur_pkgs" | tr -d ' ')" ]; then
+    if command -v paru >/dev/null 2>&1; then
+        # shellcheck disable=SC2086
+        paru -S --needed --noconfirm $aur_pkgs
+    else
+        echo "warning: paru not found — skipping AUR packages: $aur_pkgs" >&2
+    fi
+fi
+
+{{ else if eq .chezmoi.os "darwin" -}}
+if ! command -v brew >/dev/null 2>&1; then
+    echo "error: homebrew not installed — https://brew.sh" >&2
+    exit 1
+fi
+brew install \
+{{ range .packages.darwin.brew }}    {{ . }} \
+{{ end }}    && true
+
+brew install --cask \
+{{ range .packages.darwin.cask }}    {{ . }} \
+{{ end }}    && true
+{{ end -}}