cleanup: remove invented zsh override layer, harden moondoc

Earlier ClaudeCode sessions had wired a `~/.zshrc.d/*.zsh` snippet loop
plus a `~/.zshrc.local` fallback into defaults/shell/zshrc and made
post-install.sh create the directory unconditionally — neither is a zsh
convention nor documented anywhere. Remove both, simplify post-install
to write only `source /etc/zsh/zshrc.moonarch`, drop stale rustup
next-step hint, drop dead `confirm()` in lib.sh (orphan since
transform.sh deletion 2026-04-21).

moonarch-doctor: replace useless existence checks (zshrc.moonarch,
/usr/share/moonarch/) with real signal. User-service and helper-script
lists now derive from `pacman -Qql moonarch-git` (drift-proof) plus an
explicit list of post-install-enabled externals (currently `stasis`).
New udev-effectiveness check for charge_control_end_threshold —
verifies group=wheel + group-writable, surfaces broken rules instead
of staying silent.

Translate two German ABOUTME comments (moonarch-waybar-cpugov,
moonarch-waybar-gpustat) to English for consistency.

scripts/moonarch-doctor

@@ -168,8 +168,18 @@ for svc in NetworkManager bluetooth greetd systemd-timesyncd ufw auto-cpufreq; d
 done
 
 # Battery conservation service (laptop only)
-if [[ -f /sys/class/power_supply/BAT0/charge_control_end_threshold ]]; then
+THRESHOLD_FILE="/sys/class/power_supply/BAT0/charge_control_end_threshold"
+if [[ -f "$THRESHOLD_FILE" ]]; then
     check_system_service moonarch-batsaver
+
+    # Verify udev rule effectiveness — file must be group=wheel and group-writable
+    THRESHOLD_GROUP=$(stat -c '%G' "$THRESHOLD_FILE")
+    THRESHOLD_PERMS=$(stat -c '%a' "$THRESHOLD_FILE")
+    if [[ "$THRESHOLD_GROUP" == "wheel" ]] && [[ "${THRESHOLD_PERMS:1:1}" -ge 6 ]]; then
+        pass "battery threshold writable by wheel (udev rule active)"
+    else
+        fail "battery threshold not writable by wheel (group=$THRESHOLD_GROUP, mode=$THRESHOLD_PERMS — udev rule not applied)"
+    fi
 else
     pass "moonarch-batsaver (skipped — no battery threshold support)"
 fi
@@ -180,10 +190,19 @@ section "User Services"
 
 if [[ $EUID -eq 0 ]]; then
     warn "Running as root — skipping user service checks"
-else
-    for svc in kanshi wlsunset stasis walker nautilus cliphist-text cliphist-image; do
+elif pacman -Qq moonarch-git &>/dev/null; then
+    EXPECTED_SVCS=()
+    while IFS= read -r svc_file; do
+        EXPECTED_SVCS+=("$(basename "$svc_file" .service)")
+    done < <(pacman -Qql moonarch-git | grep -E '^/etc/systemd/user/[^/]+\.service$')
+    # Services enabled by post-install.sh from other packages
+    EXPECTED_SVCS+=(stasis)
+
+    for svc in "${EXPECTED_SVCS[@]}"; do
         check_user_service "$svc"
     done
+else
+    warn "moonarch-git not installed — skipping user service checks"
 fi
 
 # --- 4. Config Files ---
@@ -200,46 +219,30 @@ check_config_match "/etc/greetd/config.toml"         "$SRC/greetd/config.toml"
 check_config_match "/etc/greetd/niri-greeter.kdl"    "$SRC/greetd/niri-greeter.kdl"
 check_config_match "/etc/moongreet/moongreet.toml"   "$SRC/moongreet/moongreet.toml"
 
-if [[ -f /etc/zsh/zshrc.moonarch ]]; then
-    pass "/etc/zsh/zshrc.moonarch"
-else
-    fail "/etc/zsh/zshrc.moonarch (missing)"
-fi
-
 # --- 5. Helper Scripts ---
 
 section "Helper Scripts"
 
-EXPECTED_SCRIPTS=(
-    moonarch-batsaver-toggle
-    moonarch-btnote
-    moonarch-capsnote
-    moonarch-cpugov
-    moonarch-doctor
-    moonarch-nightlight
-    moonarch-sink-switcher
-    moonarch-update
-    moonarch-vpn
-    moonarch-waybar
-    moonarch-waybar-batsaver
-    moonarch-waybar-cpugov
-    moonarch-waybar-gpustat
-    moonarch-waybar-hidpp
-    moonarch-waybar-nightlight
-    moonarch-waybar-updates
-)
+if pacman -Qq moonarch-git &>/dev/null; then
+    EXPECTED_SCRIPTS=()
+    while IFS= read -r script; do
+        EXPECTED_SCRIPTS+=("$(basename "$script")")
+    done < <(pacman -Qql moonarch-git | grep -E '^/usr/bin/moonarch-[^/]+$')
 
-MISSING_SCRIPTS=()
-for script in "${EXPECTED_SCRIPTS[@]}"; do
-    if [[ ! -x "/usr/bin/$script" ]]; then
-        MISSING_SCRIPTS+=("$script")
+    MISSING_SCRIPTS=()
+    for script in "${EXPECTED_SCRIPTS[@]}"; do
+        if [[ ! -x "/usr/bin/$script" ]]; then
+            MISSING_SCRIPTS+=("$script")
+        fi
+    done
+
+    if [[ ${#MISSING_SCRIPTS[@]} -eq 0 ]]; then
+        pass "All ${#EXPECTED_SCRIPTS[@]} helper scripts present"
+    else
+        fail "Missing scripts: ${MISSING_SCRIPTS[*]}"
     fi
-done
-
-if [[ ${#MISSING_SCRIPTS[@]} -eq 0 ]]; then
-    pass "All ${#EXPECTED_SCRIPTS[@]} helper scripts present"
 else
-    fail "Missing scripts: ${MISSING_SCRIPTS[*]}"
+    warn "moonarch-git not installed — skipping helper script checks"
 fi
 
 # Symlinks
@@ -297,12 +300,6 @@ else
     warn "/var/lib/moonarch/ missing (created on first battery toggle)"
 fi
 
-if [[ -d /usr/share/moonarch ]]; then
-    pass "/usr/share/moonarch/"
-else
-    fail "/usr/share/moonarch/ missing (moonarch-git not installed?)"
-fi
-
 # --- Summary ---
 
 echo