feat(arch-layer,scripts): linux-gated desktop configs + package install scripts

niri (exact_config.d, scripts), noctalia (plugins excluded — runtime
state with embedded token), fontconfig, mimeapps.list,
niri-dynamic-workspaces, systemd user unit files (enable-state not
managed; only nirinit enabled by run_once), niri-launch vendored from
/usr/bin (unowned hand-written script, shellcheck warnings pre-existing).

Scripts: packages (pacman --needed + paru, brew on darwin, root-safe,
keyed on packages.yaml hash), gh extensions (idempotent), user services
(linux), post (tpm clone, bat cache, fc-cache). All shellcheck-clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

dot_config/niri/scripts/executable_niri-move.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+# Cascade move: column → workspace (incl. empty trailing) → monitor (cycles)
+# usage: niri-move.sh up|down
+set -euo pipefail
+dir="${1:?usage: niri-move.sh up|down}"
+opp=$([ "$dir" = down ] && echo up || echo down)
+
+cur=$(niri msg --json focused-window)
+[ "$cur" = "null" ] && exit 0
+
+out() { niri msg --json focused-output | jq -r '.name // "none"'; }
+sig() { niri msg --json focused-window | jq -rc '[.workspace_id, (.layout.pos_in_scrolling_layout // null)]'; }
+
+# 1) reorder within the column
+s0=$(sig); niri msg action "move-window-$dir" >/dev/null 2>&1 || true
+[ "$(sig)" != "$s0" ] && exit 0
+
+# 2) workspace in that direction (including the empty trailing one)
+s0=$(sig); niri msg action "move-window-to-workspace-$dir" >/dev/null 2>&1 || true
+[ "$(sig)" != "$s0" ] && exit 0
+
+# 3) adjacent monitor… or wrap to the far-end monitor
+o0=$(out); niri msg action "move-window-to-monitor-$dir" >/dev/null 2>&1 || true
+[ "$(out)" != "$o0" ] && exit 0
+while :; do
+  prev=$(out)
+  niri msg action "move-window-to-monitor-$opp" >/dev/null 2>&1 || true
+  [ "$(out)" = "$prev" ] && break
+done