feat: package lists per role, with a check-and-install script

The lists are derived rather than typed. beastix has 512 explicit packages -
years of experiments among them - so taking that as "what this machine needs"
would be meaningless. curate.sh combines four usage signals, each of which
alone has a blind spot: shell history sees no GUI application, KDE's activity
database sees no chat client, autostart sees only what starts by itself, and
flatpak entries never appear in pacman -Qqe at all. That reduces 512 to 62.

The split follows the data: what beastix and shron both have becomes the base,
the rest of beastix becomes desktop, shron's own becomes server.

base-devel is one entry in the server list rather than its 26 members. It
stopped being a package group in 2022 - "pacman -Sg base-devel" now fails
outright - and is a meta package today. base, grub and linux-lts are dropped
entirely; they arrive with the operating system.

packages.sh never removes anything. Extras are reported and left alone, for
the same reason the BookStack playbook refuses to: on a server, individual
packages carry mail and web services. It avoids process substitution because
/bin/sh is dash on Debian and a POSIX-mode bash on macOS, and this has to run
on both.

Verified on beastix: 62 wanted, 0 missing, 450 extra reported and untouched;
install is a no-op.

The server list is a snapshot from 2026-08-06 and wants re-reading when shron
is reachable again - its login session has since expired.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

packages/arch-base.txt

@@ -0,0 +1,27 @@
+# Packages wanted on every Arch machine, regardless of role.
+#
+# Derived, not curated by hand: the intersection of what beastix actually uses
+# (shell history, KDE's activity database, autostart, flatpak - see
+# .scripts/curate.sh) with what shron has installed explicitly. A package on
+# both machines has earned its place in the base by being useful with and
+# without a desktop.
+bind
+bpytop
+docker
+ex-vi-compat
+git
+htop
+lnav
+man-db
+mc
+nano
+ncdu
+neovim
+openssh
+redis
+tailscale
+tmux
+vim
+wget
+yay
+zsh