feat: package lists per role, with a check-and-install script

The lists are derived rather than typed. beastix has 512 explicit packages -
years of experiments among them - so taking that as "what this machine needs"
would be meaningless. curate.sh combines four usage signals, each of which
alone has a blind spot: shell history sees no GUI application, KDE's activity
database sees no chat client, autostart sees only what starts by itself, and
flatpak entries never appear in pacman -Qqe at all. That reduces 512 to 62.

The split follows the data: what beastix and shron both have becomes the base,
the rest of beastix becomes desktop, shron's own becomes server.

base-devel is one entry in the server list rather than its 26 members. It
stopped being a package group in 2022 - "pacman -Sg base-devel" now fails
outright - and is a meta package today. base, grub and linux-lts are dropped
entirely; they arrive with the operating system.

packages.sh never removes anything. Extras are reported and left alone, for
the same reason the BookStack playbook refuses to: on a server, individual
packages carry mail and web services. It avoids process substitution because
/bin/sh is dash on Debian and a POSIX-mode bash on macOS, and this has to run
on both.

Verified on beastix: 62 wanted, 0 missing, 450 extra reported and untouched;
install is a no-op.

The server list is a snapshot from 2026-08-06 and wants re-reading when shron
is reachable again - its login session has since expired.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

packages/arch-base.txt

@@ -0,0 +1,27 @@
+# Packages wanted on every Arch machine, regardless of role.
+#
+# Derived, not curated by hand: the intersection of what beastix actually uses
+# (shell history, KDE's activity database, autostart, flatpak - see
+# .scripts/curate.sh) with what shron has installed explicitly. A package on
+# both machines has earned its place in the base by being useful with and
+# without a desktop.
+bind
+bpytop
+docker
+ex-vi-compat
+git
+htop
+lnav
+man-db
+mc
+nano
+ncdu
+neovim
+openssh
+redis
+tailscale
+tmux
+vim
+wget
+yay
+zsh

packages/arch-desktop.txt

@@ -0,0 +1,47 @@
+# Packages for the desktop role, on top of arch-base.txt.
+#
+# From the same four usage signals on beastix, minus everything shron also has.
+# The original 512 explicit packages are years of experiments; these are the
+# ones something actually points at.
+android-tools
+blueman
+brscan4
+claude-code
+clicker-git
+cwitch
+firefox
+flameshot
+hytale-launcher-bin
+inetutils
+kdeconnect
+kdotool
+keepassxc
+kitty
+libpulse
+lsd
+mtr-gtk
+networkmanager
+ntfs-3g
+openai-codex
+pamixer
+path-of-building-community-git
+pdftk
+pipewire
+pipewire-pulse
+redshift
+seatd
+signal-desktop
+smartmontools
+snapper
+steam
+sway
+tailwindcss-bin
+teamspeak
+thunderbird
+uxplay
+whois
+wine
+wireplumber
+yazi
+ytdl
+zoiper-bin

packages/arch-server.txt

@@ -0,0 +1,78 @@
+# Packages for the server role, on top of arch-base.txt.
+#
+# Taken from shron's explicit list of 2026-08-06. Re-check it when shron is
+# reachable again - the snapshot was read while a login session still existed,
+# and that session has since expired.
+#
+# base-devel appears as a single entry rather than its 26 members. It stopped
+# being a package group in 2022 and is a meta package now, so pulling in the
+# members individually is both noisier and no longer how it is installed.
+# base, grub and linux-lts are left out entirely: they come with the operating
+# system and nobody installs them from a dotfiles script.
+7zip
+acme.sh
+base-devel
+btop
+caddy
+certbot
+certbot-dns-gandi
+certbot-nginx
+composer
+crowdsec
+crowdsec-firewall-bouncer-iptables
+docker-compose
+dotpac
+endlessh-git
+fail2ban
+ffmpeg
+figlet
+fzf
+gdu
+gitmux
+kitty-shell-integration
+lazydocker
+libappimage
+libpam-google-authenticator
+librsvg
+libxcrypt-compat
+links
+mariadb
+mdadm
+mtools
+mtr
+net-tools
+nextcloud-client
+nginx
+nmon
+ntfysh-bin
+php
+php-apcu
+php-fpm
+php-gd
+php-imagick
+php-legacy
+php-legacy-gd
+php-legacy-memcache
+php-legacy-memcached
+php-legacy-odbc
+php-legacy-redis
+php-legacy-sodium
+php-legacy-sqlite
+php-legacy-tidy
+php-redis
+php-sodium
+php-sqlite
+php-tidy
+powerline
+progress
+python-pip
+python-pipx
+rsync
+screen
+sshfs
+teamspeak3-server
+unace
+unarj
+unrar
+unzip
+zip

packages/brew-cask-mobile.txt

@@ -0,0 +1,38 @@
+# Homebrew casks for the mobile role - applications rather than command line
+# tools, installed with "brew install --cask".
+alfred
+appcleaner
+claude-code
+codex
+cyberduck
+dbeaver-community
+drawio
+font-hack-nerd-font
+font-inconsolata-nerd-font
+font-ubuntu-mono-nerd-font
+font-ubuntu-nerd-font
+ghostty
+gimp
+iterm2
+joplin
+jordanbaird-ice
+karabiner-elements
+keepassxc
+kitty
+libreoffice
+mactex
+mullvad-vpn
+mullvadvpn
+neovide
+neovide-app
+nextcloud
+obsidian
+openvpn-connect
+rectangle
+rustdesk
+sublime-text
+thunderbird@esr
+utm
+vimr
+vlc
+wireshark-chmodbpf

packages/brew-mobile.txt

@@ -0,0 +1,38 @@
+# Homebrew formulae for the mobile role (the Mac).
+#
+# "brew leaves" rather than "brew list": leaves are the things asked for, the
+# full list is those plus everything dragged in as a dependency.
+aria2
+bat
+cabextract
+cdrtools
+colima
+composer
+docker
+docker-compose
+fd
+fzf
+git-delta
+go
+hashcat
+helix
+imapsync
+john
+lazygit
+midnight-commander
+nmap
+node
+perl
+putty
+pypy
+ripgrep
+rust
+tailscale
+telnet
+tmux
+tree
+vim
+wget
+wimlib
+wireguard-tools
+wireshark

packages/flatpak-desktop.txt

@@ -0,0 +1,6 @@
+# Flatpaks on the desktop.
+#
+# These never appear in "pacman -Qqe", which is why they need their own list -
+# a package survey based on pacman alone silently loses them.
+com.hypixel.HytaleLauncher
+org.gnome.Mines