chore(dotfiles): streamline workstation configuration workflows

system-config/README.md

@@ -61,9 +61,27 @@ does not explain a package. System and user units use the same naming:
 
 ## Commands
 
+From the repository root, run common workflows through the
+`./system-config/decman` wrapper, which uses fixed Decman arguments:
+
+```bash
+./system-config/decman verify
+./system-config/decman dry-run
+./system-config/decman apply
+```
+
+`dry-run` and `apply` first run `verify`. They invoke Decman with `--no-hooks`,
+matching the deliberately review-first direct commands below. `apply` changes
+system state; use it only after reviewing the dry run.
+
+The wrapper locates its configuration relative to itself, so its commands run
+from the `system-config` directory. Command output and errors stream directly
+to the terminal. If a child command fails, the wrapper prints the failed command
+and returns its exit status. A missing executable returns `127`, another
+execution error (including a permission error) returns `126`, and an
+interrupted workflow returns `130`.
+
 ```bash
-cd ~/system-config
-./scripts/verify.py
 sudo decman --source source.py --dry-run --no-hooks
 sudo decman --source source.py --no-hooks
 ```
@@ -75,8 +93,10 @@ orphan cleanup from removing dependencies during adoption.
 After intentional package changes, regenerate and review concern lists:
 
 ```bash
-./scripts/split_packages.py
-./scripts/refresh_orphan_guards.py
-./scripts/verify.py
-git diff
+./system-config/decman refresh-package-state
+yadm diff -- system-config
 ```
+
+`refresh-package-state` runs `split-packages`, `refresh-orphan-guards`, and
+`verify` in that order. Those individual file-changing commands are also
+available through the dispatcher when only one is needed.