Enable first-run units one at a time, and test that units are shipped

The Thunderbolt approval watcher is enabled by its setup command, a
migration and first-run, but no package put it in a user unit folder and
nothing installed it. On edge the migration failed with "Unit
omarchy-thunderbolt-authorization.service does not exist", so every later
migration stayed pending. First-run failed too, and enabled none of its
units: given a list, systemctl enables nothing when one unit is unknown.

The units are now shipped by the settings packages (omarchy-pkgs#922).
Here, first-run enables its units one at a time, so a unit missing from a
build costs only that unit, and config-test fails when a unit under
default/systemd/user is enabled without being shipped or installed first.

test/shell.d/config-test.sh

@@ -173,6 +173,19 @@ for source, destination, legacy in package_defaults:
   if destination and (source not in pkgbuild or destination not in pkgbuild):
     errors.append(f"PKGBUILD does not explicitly install {source} -> {destination}")
 
+# A user unit has to be on the machine before anything turns it on: shipped in
+# /usr/lib/systemd/user, or copied out of default/ by the command enabling it.
+scripts = [path.read_text(errors="ignore") for folder in ("bin", "install", "migrations")
+           for path in (root / folder).rglob("*") if path.is_file()]
+for unit in sorted(path.name for path in (root / "default/systemd/user").glob("*.service")):
+  if f"/usr/lib/systemd/user/{unit}" in pkgbuild:
+    continue
+  named = [text for text in scripts if unit in text]
+  if not any("default/systemd/user/" in text for text in named):
+    errors.append(f"PKGBUILD does not ship default/systemd/user/{unit} and no command installs it")
+  elif any("systemctl --user enable" in text and "default/systemd/user/" not in text for text in named):
+    errors.append(f"{unit} is enabled without being shipped by PKGBUILD or installed first")
+
 # Existing users have an absolute wants symlink to the old unit path, and the
 # migration that repoints it only runs for users who run an update -- the
 # opposite of who the notifier is for. Dropping this alias strands them.

test/shell.d/first-run-test.sh

@@ -33,3 +33,24 @@ if grep -F 'skip-first-run-update-notification' "$ROOT/install/user/first-run/wi
 fi
 
 pass "first-run uses one lifecycle completion marker"
+
+# systemctl enables none of a list when one unit in it is unknown, so a unit
+# missing from a build must cost first-run only that unit.
+cat >"$mock_bin/systemctl" <<'SH'
+#!/bin/bash
+[[ $* != *omarchy-sleep-lock.service* ]] || exit 1
+printf '%s\n' "$*" >>"$OMARCHY_TEST_CALLS"
+SH
+cat >"$mock_bin/omarchy-hook-install" <<'SH'
+#!/bin/bash
+echo hook >>"$OMARCHY_TEST_CALLS"
+SH
+chmod +x "$mock_bin/systemctl" "$mock_bin/omarchy-hook-install"
+
+if PATH="$mock_bin:$PATH" OMARCHY_TEST_CALLS="$test_tmp/calls" bash "$ROOT/install/user/first-run/enable-user-units.sh"; then
+  fail "first-run reports a unit it could not enable"
+fi
+for expected in bt-agent.service omarchy-crash-watch.service hook; do
+  grep -Fq "$expected" "$test_tmp/calls" || fail "a unit missing from the build does not cost first-run $expected"
+done
+pass "a unit missing from the build costs first-run only that unit"