Split user defaults into skel seed, finalize, and resync

Reorganizes Omarchy 4 around three layers for populating $HOME:

  Seed:     omarchy-settings ships defaults to /etc/skel; useradd -m
            copies them on user creation
  Finalize: omarchy-finalize-user (renamed from omarchy-setup-user)
            handles only the runtime tweaks /etc/skel can't do — skill
            symlinks, xdg-user-dirs, default browser/mailto, vconsole→hypr
            keyboard sync, and install/user/all.sh
  Resync:   omarchy-reinstall-configs is the explicit, destructive
            resync of /etc/skel into an existing user's $HOME

Package-owned files move out of config/ into default/, where the
omarchy-settings PKGBUILD installs them to real system paths:

  config/environment.d/fcitx.conf            -> /usr/lib/environment.d/
  config/fontconfig/fonts.conf               -> /usr/share/fontconfig/conf.avail/
  config/mimeapps.list                       -> /usr/share/applications/
  config/omarchy.ttf                         -> /usr/share/fonts/omarchy/
  config/systemd/user/*.service              -> /usr/lib/systemd/user/
  config/uwsm/default                        -> /usr/share/omarchy/default/uwsm/
  config/uwsm/env                            -> /usr/share/uwsm/env.d/10-omarchy
  config/xdg-terminals.list                  -> /usr/share/xdg-terminal-exec/

omarchy-upgrade-to-4 grows a 'retire' action (renamed from 'move' to
clarify nothing is copied — the system path is owned by the new package
once the user's hash-matched ~/.config copy is removed). Mismatched
copies are kept as backups so user overrides survive the upgrade.

Other simplifications:

  - Single env bootstrap at default/bash/env-bootstrap sourced by
    /etc/profile.d/omarchy.sh, /etc/skel/.bashrc,
    /usr/share/uwsm/env.d/10-omarchy, and default/bash/envs. PATH
    prepend only in dev-link mode (production uses /usr/bin/omarchy-*).
  - omarchy-refresh-config reads from /etc/skel/.config so refresh
    means 'snap to skel'.
  - omarchy-reinstall-configs collapses to 'cp -af /etc/skel/. ~/'
    plus limine/plymouth/nvim refresh.
  - omarchy-font-set uses awk against our own 30-omarchy.conf instead
    of xmlstarlet; xmlstarlet dropped from omarchy-base.packages.
  - Defer user systemd enables (bt-agent, sleep-lock,
    recover-internal-monitor) to first-run via
    install/user/first-run/enable-user-units.sh; delete
    omarchy-user-systemctl-enable and the per-hardware install
    scripts that called it.
  - Wireplumber bluetooth-a2dp-autoconnect.conf moves to config/ so
    /etc/skel ships it; install/user/hardware/bluetooth.sh deleted.
  - Default terminal switched to foot.desktop.
  - docs/file-layout.md documents the three-layer model and the
    build-time repo→path map.

install/user/all.sh

@@ -2,9 +2,7 @@ run_logged "$OMARCHY_INSTALL/user/theme.sh"
 run_logged "$OMARCHY_INSTALL/user/git.sh"
 run_logged "$OMARCHY_INSTALL/user/xcompose.sh"
 run_logged "$OMARCHY_INSTALL/user/mise-work.sh"
-run_logged "$OMARCHY_INSTALL/user/sleep-lock.sh"
 
-run_logged "$OMARCHY_INSTALL/user/hardware/bluetooth.sh"
 run_logged "$OMARCHY_INSTALL/user/hardware/asus/fix-audio-mixer.sh"
 run_logged "$OMARCHY_INSTALL/user/hardware/asus/fix-mic.sh"
 run_logged "$OMARCHY_INSTALL/user/hardware/framework/fix-f13-amd-audio-input.sh"

install/user/first-run/enable-user-units.sh

@@ -0,0 +1,15 @@
+#!/bin/bash
+
+# Enable the user systemd units we ship. Runs at first-run rather than at
+# finalize-user time because the user manager isn't live during the ISO
+# chroot — by first-run, the Hyprland/uwsm session is up and `systemctl
+# --user enable` writes the correct .wants symlinks based on each unit's
+# [Install]/WantedBy. ConditionPath* in the unit files keep the enabled
+# units inert on hardware they don't apply to.
+
+set -euo pipefail
+
+systemctl --user enable \
+  bt-agent.service \
+  omarchy-recover-internal-monitor.service \
+  omarchy-sleep-lock.service

install/user/hardware/bluetooth.sh

@@ -1,13 +0,0 @@
-mkdir -p ~/.config/wireplumber/wireplumber.conf.d/
-cp "$OMARCHY_PATH/default/wireplumber/wireplumber.conf.d/bluetooth-a2dp-autoconnect.conf" ~/.config/wireplumber/wireplumber.conf.d/
-
-# Quickshell.Bluetooth has no Agent API, so the omarchy.bluetooth plugin
-# can't answer the auth prompts bluez issues during pair(). bt-agent registers
-# a NoInputNoOutput agent on the system bus so pair() actually completes.
-mkdir -p ~/.config/systemd/user/
-cp "$OMARCHY_PATH/config/systemd/user/bt-agent.service" ~/.config/systemd/user/
-if declare -F omarchy_user_systemctl_enable >/dev/null; then
-  omarchy_user_systemctl_enable bt-agent.service
-else
-  systemctl --user enable bt-agent.service
-fi

install/user/hardware/recover-internal-monitor.sh

@@ -1 +0,0 @@
-systemctl --user enable omarchy-recover-internal-monitor.service

install/user/sleep-lock.sh

@@ -1,7 +0,0 @@
-mkdir -p ~/.config/systemd/user/
-cp "$OMARCHY_PATH/config/systemd/user/omarchy-sleep-lock.service" ~/.config/systemd/user/
-if declare -F omarchy_user_systemctl_enable >/dev/null; then
-  omarchy_user_systemctl_enable omarchy-sleep-lock.service
-else
-  systemctl --user enable omarchy-sleep-lock.service
-fi