feat(desktop): consolidate declarative workstation profile

Capture desktop-specific system, session, Noctalia, and Pi integration alongside shared laptop support. Retire obsolete X11 configuration and make package ownership explicit for repeatable Decman deployments.

system-config/README.md

@@ -6,16 +6,18 @@ A small, declarative Arch configuration managed by Decman.
 
 - **Concerns live in `packages/`**: each concern has a native (`*-repo.txt`)
   and AUR (`*-aur.txt`) list.
-- **Hosts live in `hosts.py`**: a host composes concerns. `laptop()` contains
-  every explicit package. `desktop()` begins with shared concerns only.
+- **Hosts live in `hosts.py`**: a host composes package concerns and explicit
+  system state. `desktop()` owns this desktop's boot, storage, NVIDIA, input,
+  SDDM, network-policy, and user-session configuration.
 - **System files live in `config/system/`**: shared files go in `common/`;
   hardware, sleep/logind, and boot policy go in the relevant host directory.
 - **State lives in `manifests/`**: units follow the same concern and host
   scopes as packages.
 - **Python glue lives in `modules/`**: package and system-state adapters only.
 
-No yadm migration, user-home dotfiles, or application state is managed here.
-Those can be added later as small, explicit modules.
+Decman owns the listed system files and selected durable home configuration.
+yadm owns remaining portable dotfiles; application state, browser profiles,
+NetworkManager connection profiles, and project build output remain unmanaged.
 
 ## System policy
 
@@ -29,8 +31,9 @@ Those can be added later as small, explicit modules.
   remains in `config/system/laptop/systemd/`.
 - `config/system/laptop/power/tlp.conf` owns laptop power policy. TLP reads
   `/etc/tlp.conf` after drop-ins, so a whole-file policy is required here.
-- `config/system/laptop/boot/mkinitcpio.conf` owns encrypted-root and resume
-  initramfs hooks; its module rebuilds the initramfs after a change.
+- `config/system/{laptop,desktop}/boot/mkinitcpio.conf` owns encrypted-root
+  and resume initramfs hooks for each host; its module rebuilds the initramfs
+  after a change.
 - `config/system/laptop/refind/` owns the laptop ESP rEFInd configuration and
   encrypted-root kernel options. It is intentionally laptop-only.
 - `config/system/laptop/iwlwifi.conf` retains the Wi-Fi 6 stability workaround;
@@ -49,7 +52,7 @@ remove those explicitly in a separate reviewed package change.
 | --- | --- |
 | Shared | core, wayland, fonts, development, productivity, media, research, network, services |
 | Laptop | hardware, legacy; hardware units |
-| Desktop | shared concerns now; add `packages/desktop/<concern>-{repo,aur}.txt` when hardware/software differs |
+| Desktop | shared concerns, `common/hardware`, and a reviewable `desktop/local` set; host state is in `config/system/desktop/` |
 
 Every package must have a named purpose. Add a new concern when an existing one
 does not explain a package. System and user units use the same naming: