feat: package lists per role, with a check-and-install script

The lists are derived rather than typed. beastix has 512 explicit packages -
years of experiments among them - so taking that as "what this machine needs"
would be meaningless. curate.sh combines four usage signals, each of which
alone has a blind spot: shell history sees no GUI application, KDE's activity
database sees no chat client, autostart sees only what starts by itself, and
flatpak entries never appear in pacman -Qqe at all. That reduces 512 to 62.

The split follows the data: what beastix and shron both have becomes the base,
the rest of beastix becomes desktop, shron's own becomes server.

base-devel is one entry in the server list rather than its 26 members. It
stopped being a package group in 2022 - "pacman -Sg base-devel" now fails
outright - and is a meta package today. base, grub and linux-lts are dropped
entirely; they arrive with the operating system.

packages.sh never removes anything. Extras are reported and left alone, for
the same reason the BookStack playbook refuses to: on a server, individual
packages carry mail and web services. It avoids process substitution because
/bin/sh is dash on Debian and a POSIX-mode bash on macOS, and this has to run
on both.

Verified on beastix: 62 wanted, 0 missing, 450 extra reported and untouched;
install is a no-op.

The server list is a snapshot from 2026-08-06 and wants re-reading when shron
is reachable again - its login session has since expired.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

packages/arch-desktop.txt

@@ -0,0 +1,47 @@
+# Packages for the desktop role, on top of arch-base.txt.
+#
+# From the same four usage signals on beastix, minus everything shron also has.
+# The original 512 explicit packages are years of experiments; these are the
+# ones something actually points at.
+android-tools
+blueman
+brscan4
+claude-code
+clicker-git
+cwitch
+firefox
+flameshot
+hytale-launcher-bin
+inetutils
+kdeconnect
+kdotool
+keepassxc
+kitty
+libpulse
+lsd
+mtr-gtk
+networkmanager
+ntfs-3g
+openai-codex
+pamixer
+path-of-building-community-git
+pdftk
+pipewire
+pipewire-pulse
+redshift
+seatd
+signal-desktop
+smartmontools
+snapper
+steam
+sway
+tailwindcss-bin
+teamspeak
+thunderbird
+uxplay
+whois
+wine
+wireplumber
+yazi
+ytdl
+zoiper-bin