Add moonarch-update for package-based system maintenance

Simplified updater that reads package lists from /usr/share/moonarch/
instead of syncing a git repo. Designed to be shipped by the
moonarch-git package as /usr/bin/moonarch-update.

DECISIONS.md

@@ -11,3 +11,9 @@
 - **Why**: Users with existing Arch+Wayland setups should be able to adopt Moonarch without reinstalling
 - **Tradeoffs**: Hard overwrite of all configs (user + system) vs. selective/merge approach — chose hard overwrite for simplicity and consistency
 - **How**: New transform.sh with pre-flight summary, backup, DM conflict resolution, and --dry-run flag. Shared helpers extracted to lib.sh.
+
+## 2026-03-29 – Package moonarch as moonarch-git PKGBUILD
+- **Who**: Dominik, Ragnar
+- **Why**: System artifacts (XDG configs, helper scripts, zsh config, wallpaper) should be managed by pacman for clean deployment, versioning, rollback, and deinstallation
+- **Tradeoffs**: /etc/xdg/ configs NOT in backup= (moonarch philosophy: system defaults flow through, users override in ~/.config/). /etc/greetd/ and /etc/moongreet/ NOT owned by package (owned by greetd/moongreet-git, overwritten via .install hook). Helper scripts move from /usr/local/bin/ to /usr/bin/ (FHS for package-managed files)
+- **How**: moonarch-git PKGBUILD in moonarch-pkgbuilds repo. sweet-cursors-git as separate package. moonarch-update simplified (no git-sync, pacman handles file deployment). Installer scripts (post-install.sh, transform.sh) remain for orchestration, will be refactored in a follow-up to delegate file deployment to `paru -S moonarch-git`

scripts/moonarch-update

@@ -0,0 +1,107 @@
+#!/bin/bash
+# ABOUTME: Moonarch system updater — updates packages and reconciles package lists.
+# ABOUTME: Shipped as /usr/bin/moonarch-update by the moonarch-git package.
+
+set -euo pipefail
+
+# --- Helper functions ---
+
+log() {
+    echo -e "\e[1;34m[Moonarch]\e[0m $*"
+}
+
+err() {
+    echo -e "\e[1;31m[Moonarch ERROR]\e[0m $*" >&2
+}
+
+read_packages() {
+    grep -v '^\s*#' "$1" | grep -v '^\s*$'
+}
+
+confirm() {
+    read -r -p "$1 [y/N] " response
+    [[ "$response" =~ ^[yY]$ ]]
+}
+
+OFFICIAL_PACKAGES="/usr/share/moonarch/official.txt"
+AUR_PACKAGES="/usr/share/moonarch/aur.txt"
+
+# --- Prerequisites ---
+
+if [[ $EUID -eq 0 ]]; then
+    err "Do NOT run as root. The script uses sudo where needed."
+    exit 1
+fi
+
+# --- 1. Update system packages ---
+
+log "=== Update system packages ==="
+
+if confirm "Run pacman -Syu?"; then
+    sudo pacman -Syu
+else
+    log "System update skipped."
+fi
+
+if command -v paru &>/dev/null; then
+    if confirm "Update AUR packages (paru -Sua)?"; then
+        paru -Sua
+    else
+        log "AUR update skipped."
+    fi
+fi
+
+# --- 2. Reconcile package lists ---
+
+log "=== Reconcile package lists ==="
+
+if [[ -f "$OFFICIAL_PACKAGES" ]]; then
+    MISSING_OFFICIAL=$(comm -23 <(read_packages "$OFFICIAL_PACKAGES" | sort) <(pacman -Qqe | sort) || true)
+    if [[ -n "$MISSING_OFFICIAL" ]]; then
+        log "Missing official packages:"
+        echo "$MISSING_OFFICIAL"
+        if confirm "Install?"; then
+            # shellcheck disable=SC2086
+            sudo pacman -S --needed --noconfirm $MISSING_OFFICIAL
+        fi
+    else
+        log "All official packages installed."
+    fi
+fi
+
+if [[ -f "$AUR_PACKAGES" ]] && command -v paru &>/dev/null; then
+    MISSING_AUR=$(comm -23 <(read_packages "$AUR_PACKAGES" | sort) <(pacman -Qqe | sort) || true)
+    if [[ -n "$MISSING_AUR" ]]; then
+        log "Missing AUR packages:"
+        echo "$MISSING_AUR"
+        if confirm "Install?"; then
+            # shellcheck disable=SC2086
+            paru -S --needed --noconfirm $MISSING_AUR
+        fi
+    else
+        log "All AUR packages installed."
+    fi
+fi
+
+# --- 3. Orphaned packages ---
+
+log "=== Orphaned packages ==="
+
+ORPHANS=$(pacman -Qdtq 2>/dev/null || true)
+if [[ -n "$ORPHANS" ]]; then
+    log "Orphaned packages found:"
+    echo "$ORPHANS"
+    if confirm "Remove?"; then
+        # shellcheck disable=SC2086
+        sudo pacman -Rsn --noconfirm $ORPHANS
+    fi
+else
+    log "No orphaned packages."
+fi
+
+# --- Done ---
+
+log ""
+log "============================================"
+log "  Moonarch update complete!"
+log "============================================"