Let systemd-oomd kill a runaway app instead of losing the session (#6445)

Nothing stood between "memory is tight" and "processes die at random":
the kernel OOM killer only fires after an allocation has already failed,
so a machine under pressure thrashes in reclaim until something breaks
somewhere fatal — seen in practice as Hyprland taking SIGBUS mid-memcpy
from a client shm pool that memory pressure was tearing down.

Enable systemd-oomd, which keys on PSI stall time rather than free
pages, and mark app.slice — and only app.slice — as its kill candidate.
Hyprland runs in session.slice, so the compositor is structurally
ineligible as a victim: oomd takes the app that caused the pressure and
the session survives. Thresholds (50% stall over 20s, Fedora's desktop
defaults) live in an oomd.conf.d drop-in; candidacy ships as a vendor
drop-in under /usr/lib/systemd/user so existing users get it on package
upgrade with no per-user seeding.

New installs enable the daemon from enable-services.sh; a migration
covers existing ones, restarting an already-running oomd so it doesn't
keep stale thresholds until reboot.

Deliberately not earlyoom: it triggers only when free RAM and free swap
are both under threshold, so Omarchy's large, mostly-idle swapfiles
keep it asleep through exactly this failure.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

default/systemd/user/app.slice.d/10-oomd.conf

@@ -0,0 +1,16 @@
+# Make user apps the only thing systemd-oomd is allowed to kill.
+#
+# Hyprland runs in session.slice, as wayland-wm@hyprland.desktop.service, while
+# everything launched through uwsm-app lands in app.slice/app-*.scope. Marking
+# only app.slice as a kill candidate means the compositor is structurally
+# ineligible: oomd takes the browser or terminal that caused the pressure, and
+# the session survives to show the notification about it. Setting this on
+# user@.service instead would put the compositor back in the candidate pool.
+#
+# Swap kill is a backstop for the slower shape of the same problem, where swap
+# fills before pressure spikes. It uses the global SwapUsedLimit (90%) from
+# /etc/systemd/oomd.conf.d/10-omarchy.conf, which also carries the pressure
+# thresholds.
+[Slice]
+ManagedOOMMemoryPressure=kill
+ManagedOOMSwap=kill