Centralize service enables into install/config/enable-services.sh

The previous setup scattered systemctl enables across docker.sh,
printer.sh, bluetooth.sh, network.sh, powerprofilesctl-rules.sh, and
kernel-modules-hook.sh. Some used chrootable_systemctl_enable; others
used bare 'sudo systemctl enable'. Centralizing makes the install-time
service surface auditable in one place and consistent in chroot/non-chroot
behavior.

install/config/enable-services.sh enables:
- bluetooth.service
- cups.service, cups-browsed.service, avahi-daemon.service
- docker.socket
- iwd.service
- linux-modules-cleanup.service
- power-profiles-daemon.service

Each via chrootable_systemctl_enable, which uses 'enable --now' on a live
system and bare 'enable' in chroot (set OMARCHY_CHROOT_INSTALL=1).

Stays in original script (deliberately):
- sddm.sh: bare 'systemctl enable sddm.service' (no --now during install
  would log the user out; lives in install/login/)
- limine-snapper.sh: limine-snapper-sync (bootloader-specific path)
- first-run/firewall.sh: ufw (deferred to first-run for UX)
- hardware/{t2,intel/lpmd,intel/thermald,apple/fix-suspend-nvme}: gated
  on hardware detection

Side cleanups:
- install/config/kernel-modules-hook.sh: DELETED (sole line was the enable
  for linux-modules-cleanup, now in enable-services.sh).
- install/config/hardware/printer.sh: DELETED (sole purpose was the
  three cups/avahi enables; nothing else to do).
- install/config/hardware/network.sh: keep the systemd-networkd-wait-online
  disable+mask; drop the iwd enable.
- install/config/hardware/bluetooth.sh: keep the AutoEnable=false sed and
  the wireplumber/bt-agent user-session setup; drop the system enable.
- install/config/docker.sh: drop the docker.socket enable.
- install/config/powerprofilesctl-rules.sh: drop the
  power-profiles-daemon enable.
- install/config/all.sh: register enable-services.sh; remove the two
  deleted entries.

install/config/all.sh

@@ -22,15 +22,16 @@ run_logged $OMARCHY_INSTALL/config/input-group.sh
 run_logged $OMARCHY_INSTALL/config/omarchy-ai-skill.sh
 run_logged $OMARCHY_INSTALL/config/pi.sh
 run_logged $OMARCHY_INSTALL/config/omarchy-toggles.sh
-run_logged $OMARCHY_INSTALL/config/kernel-modules-hook.sh
 run_logged $OMARCHY_INSTALL/config/powerprofilesctl-rules.sh
 run_logged $OMARCHY_INSTALL/config/wifi-powersave-rules.sh
 
+# Service enables centralized; run after all drop-in files are in place.
+run_logged $OMARCHY_INSTALL/config/enable-services.sh
+
 run_logged $OMARCHY_INSTALL/config/hardware/network.sh
 run_logged $OMARCHY_INSTALL/config/hardware/set-wireless-regdom.sh
 run_logged $OMARCHY_INSTALL/config/hardware/fix-fkeys.sh
 run_logged $OMARCHY_INSTALL/config/hardware/bluetooth.sh
-run_logged $OMARCHY_INSTALL/config/hardware/printer.sh
 run_logged $OMARCHY_INSTALL/config/hardware/nvidia.sh
 run_logged $OMARCHY_INSTALL/config/hardware/vulkan.sh
 

install/config/docker.sh

@@ -1,10 +1,7 @@
-# Docker config files (daemon.json, resolved drop-in, no-block-boot drop-in)
-# ship via omarchy-settings. This script only handles the runtime side:
-# - reload systemd-resolved so the new drop-in takes effect
-# - add the current user to the docker group
-# - enable docker.socket and reload systemd unit files
-
+# Docker config files ship via omarchy-settings. This script only handles
+# runtime side: reload systemd-resolved so the new drop-in takes effect and
+# add the current user to the docker group. docker.socket enable lives in
+# install/config/enable-services.sh.
 sudo systemctl restart systemd-resolved
-sudo systemctl enable docker.socket
 sudo usermod -aG docker ${USER}
 sudo systemctl daemon-reload

install/config/enable-services.sh

@@ -0,0 +1,12 @@
+# Central place for unconditional, safe-to-start-now service enables.
+# Services that should NOT be started during install (sddm, ufw) live in
+# their own scripts. Hardware-gated services (t2fanrd, intel_lpmd,
+# thermald, omarchy-nvme-suspend-fix) also live with their detection.
+chrootable_systemctl_enable bluetooth.service
+chrootable_systemctl_enable cups.service
+chrootable_systemctl_enable cups-browsed.service
+chrootable_systemctl_enable avahi-daemon.service
+chrootable_systemctl_enable docker.socket
+chrootable_systemctl_enable iwd.service
+chrootable_systemctl_enable linux-modules-cleanup.service
+chrootable_systemctl_enable power-profiles-daemon.service

install/config/hardware/bluetooth.sh

@@ -1,5 +1,4 @@
-# Turn on bluetooth by default
-chrootable_systemctl_enable bluetooth.service
+# bluetooth.service enable lives in install/config/enable-services.sh.
 
 # Persist last power state across reboots (default AutoEnable=true overrides it)
 sudo sed -i 's/^#\?AutoEnable=.*/AutoEnable=false/' /etc/bluetooth/main.conf

install/config/hardware/printer.sh

@@ -1,9 +0,0 @@
-# Printer config files now ship via omarchy-settings:
-# - etc/systemd/resolved.conf.d/10-disable-multicast.conf (package-owned drop-in)
-# - etc/nsswitch.conf (etc-overrides, replaces the previous in-place sed)
-# - etc/cups/cups-browsed.conf (etc-overrides, replaces the previous append)
-#
-# This script only handles service enables, which the configurator path needs.
-chrootable_systemctl_enable cups.service
-chrootable_systemctl_enable avahi-daemon.service
-chrootable_systemctl_enable cups-browsed.service

install/config/kernel-modules-hook.sh

@@ -1 +0,0 @@
-chrootable_systemctl_enable linux-modules-cleanup.service

install/config/powerprofilesctl-rules.sh

@@ -1,9 +1,8 @@
 # The udev rule (/etc/udev/rules.d/99-omarchy-power-profile.rules) ships via
-# omarchy-settings. This script handles the runtime side: enable the service
-# the rule's RUN+= chains through, and reload udev so the new rule takes effect.
-# Also remove the pre-rename legacy path in case the old installer ran since
-# the one-shot migration completed (idempotency for re-install/downgrade tests).
+# omarchy-settings. power-profiles-daemon.service enable lives in
+# install/config/enable-services.sh. This script just reloads udev so the
+# rule takes effect and removes the pre-rename legacy path (idempotent for
+# re-install/downgrade tests).
 sudo rm -f /etc/udev/rules.d/99-power-profile.rules
-sudo systemctl enable power-profiles-daemon
 sudo udevadm control --reload 2>/dev/null
 sudo udevadm trigger --subsystem-match=power_supply 2>/dev/null