feat(arch-layer,scripts): linux-gated desktop configs + package install scripts

niri (exact_config.d, scripts), noctalia (plugins excluded — runtime
state with embedded token), fontconfig, mimeapps.list,
niri-dynamic-workspaces, systemd user unit files (enable-state not
managed; only nirinit enabled by run_once), niri-launch vendored from
/usr/bin (unowned hand-written script, shellcheck warnings pre-existing).

Scripts: packages (pacman --needed + paru, brew on darwin, root-safe,
keyed on packages.yaml hash), gh extensions (idempotent), user services
(linux), post (tpm clone, bat cache, fc-cache). All shellcheck-clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

dot_config/noctalia/plugins.json

@@ -0,0 +1,32 @@
+{
+    "sources": [
+        {
+            "enabled": true,
+            "name": "Noctalia Plugins",
+            "url": "https://github.com/noctalia-dev/noctalia-plugins"
+        }
+    ],
+    "states": {
+        "github-feed": {
+            "enabled": true,
+            "sourceUrl": "https://github.com/noctalia-dev/noctalia-plugins"
+        },
+        "habitica": {
+            "enabled": true,
+            "sourceUrl": "https://github.com/noctalia-dev/noctalia-plugins"
+        },
+        "kde-connect": {
+            "enabled": true,
+            "sourceUrl": "https://github.com/noctalia-dev/noctalia-plugins"
+        },
+        "khal-agenda-widget": {
+            "enabled": true,
+            "sourceUrl": "https://github.com/noctalia-dev/noctalia-plugins"
+        },
+        "weather-indicator": {
+            "enabled": true,
+            "sourceUrl": "https://github.com/noctalia-dev/noctalia-plugins"
+        }
+    },
+    "version": 2
+}