Enable first-run units one at a time, and test that units are shipped

The Thunderbolt approval watcher is enabled by its setup command, a
migration and first-run, but no package put it in a user unit folder and
nothing installed it. On edge the migration failed with "Unit
omarchy-thunderbolt-authorization.service does not exist", so every later
migration stayed pending. First-run failed too, and enabled none of its
units: given a list, systemctl enables nothing when one unit is unknown.

The units are now shipped by the settings packages (omarchy-pkgs#922).
Here, first-run enables its units one at a time, so a unit missing from a
build costs only that unit, and config-test fails when a unit under
default/systemd/user is enabled without being shipped or installed first.

install/user/first-run/enable-user-units.sh

@@ -12,7 +12,11 @@
 set -euo pipefail
 
 systemctl --user daemon-reload
-systemctl --user enable --now \
+
+# One at a time: given a list, systemctl enables none of it when it cannot find
+# one unit, and that should not cost the session its bluetooth agent as well.
+failed=0
+for unit in \
   bt-agent.service \
   owed.service \
   omarchy-recover-internal-monitor.service \
@@ -21,6 +25,9 @@ systemctl --user enable --now \
   omarchy-fcitx5.service \
   omarchy-crash-watch.service \
   omarchy-usb-authorization.service \
-  omarchy-thunderbolt-authorization.service
+  omarchy-thunderbolt-authorization.service; do
+  systemctl --user enable --now "$unit" || failed=1
+done
 
 omarchy-hook-install theme-set /usr/share/owe/10-owe-sync
+exit "$failed"