chore(packages): declare every tool the configs reference

Audit of configs, scripts, tmux-palette items and television cables
against installed packages. Adds the missing pacman/AUR/brew entries,
a [omarchy] repo list installed only where that repo is configured,
and cargo installs in 40-post. 10-packages filters lists with pacman -T
so provider packages (mise-bin, yazi-git) are not replaced, and uses
yay with paru as fallback. noctalia-shell -> noctalia-git (AUR name).

docs/chezmoi/scripts.mdx

@@ -15,7 +15,7 @@ Six scripts run during `chezmoi apply`. Four live in `.chezmoiscripts/`, a direc
   <Step title="20-gh-extensions (after, onchange)">Install gh extensions.</Step>
   <Step title="25-skills (after, onchange)">Install and prune agent skills.</Step>
   <Step title="30-user-services (after, once)">Enable systemd user units on Linux (nirinit, kitty-day-save, projects-sync.timer).</Step>
-  <Step title="40-post (after, onchange)">bat cache, font cache.</Step>
+  <Step title="40-post (after, onchange)">bat cache, font cache, cargo installs.</Step>
   <Step title="build-bat-cache (after, onchange)">Rebuild bat cache when its theme or config changes.</Step>
   <Step title="install-yazi-plugins (after, onchange)">Reinstall yazi plugins when the manifest changes.</Step>
 </Steps>
@@ -26,7 +26,7 @@ Six scripts run during `chezmoi apply`. Four live in `.chezmoiscripts/`, a direc
 | `.chezmoiscripts/run_onchange_after_20-gh-extensions.sh.tmpl` | after | onchange | sha256 of `packages.shared.gh_extensions` as JSON |
 | `.chezmoiscripts/run_onchange_after_25-skills.sh.tmpl` | after | onchange | sha256 of `.skills` as JSON |
 | `.chezmoiscripts/run_once_after_30-user-services.sh.tmpl` | after | once | Runs once per distinct rendered content |
-| `.chezmoiscripts/run_onchange_after_40-post.sh.tmpl` | after | onchange | Only edits to the script itself (or an OS change) |
+| `.chezmoiscripts/run_onchange_after_40-post.sh.tmpl` | after | onchange | sha256 of `packages.shared.cargo` as JSON; also edits to the script itself or an OS change |
 | `run_onchange_after_build-bat-cache.sh.tmpl` | after | onchange | sha256 of `dot_config/bat/themes/cyberdream.tmTheme` and `dot_config/bat/config` |
 | `run_onchange_after_install-yazi-plugins.sh.tmpl` | after | onchange | sha256 of `~/.config/yazi/package.toml` (empty when the file is absent) |
 
@@ -46,10 +46,10 @@ Six scripts run during `chezmoi apply`. Four live in `.chezmoiscripts/`, a direc
   <Tab title="Linux">
 
 1. Uses `pacman` directly when running as root, otherwise `sudo pacman`.
-2. `pacman -S --needed --noconfirm` with every entry in `packages.arch.pacman`.
-3. For roles `desktop` and `laptop`, a second `pacman -S --needed --noconfirm` with `packages.arch.desktop.pacman`.
+2. `pacman -T` filters each list down to names no installed package provides (so `mise-bin` satisfies `mise`, `yazi-git` satisfies `yazi`), then `pacman -S --needed --noconfirm` installs the rest of `packages.arch.pacman`.
+3. For roles `desktop` and `laptop`, the same for `packages.arch.desktop.pacman`, and, when `pacman-conf -l` lists an `omarchy` repo, for `packages.arch.desktop.omarchy`.
 4. Builds the AUR list: `packages.arch.desktop.aur` plus `packages.arch.aur` for `desktop`/`laptop`, only `packages.arch.aur` for other roles.
-5. If the list is non-empty and `paru` exists, runs `paru -S --needed --noconfirm` on it. Without `paru` it prints `warning: paru not found — skipping AUR packages: …` and continues.
+5. If the list is non-empty, runs `yay -S --needed --noconfirm` on it, falling back to `paru`. With neither it prints `warning: yay/paru not found — skipping AUR packages: …` and continues.
 
   </Tab>
   <Tab title="macOS">
@@ -101,12 +101,13 @@ Other personal automation units (brain-lens, omp-loop, rclone, hermes, voxtype)
 
 ## 40-post [#40-post]
 
-`.chezmoiscripts/run_onchange_after_40-post.sh.tmpl` is post-apply housekeeping. It has no hash comment, so it only re-runs when the script itself is edited.
+`.chezmoiscripts/run_onchange_after_40-post.sh.tmpl` is post-apply housekeeping. It re-runs when the script is edited or `packages.shared.cargo` changes.
 
 | Step | Condition | Action |
 | --- | --- | --- |
 | bat cache | `bat` installed | `bat cache --build` |
 | Font cache | Linux, `fc-cache` installed | `fc-cache -f` |
+| cargo | `cargo` installed | `cargo install --locked <crate>` for each `packages.shared.cargo` entry missing from `cargo install --list` |
 
 Each step ignores failures (`|| true`). tpm is cloned by [`.chezmoiexternal.toml`](/chezmoi/externals-and-ignore#externals), not here.