feat(desktop): install librewolf as the browser

The package set provided no browser at all. Waterfox, which Arch runs,
is not in nixpkgs; packaging its upstream tarball worked but leaves
version and hash to be bumped by hand, with nothing signalling a missed
release — poor terms for the most exposed program on the machine.

librewolf comes from nixpkgs, so its updates arrive with the flake, and
it is fully substitutable. Its defaults are stricter than Waterfox's.

DECISIONS.md

@@ -1,5 +1,36 @@
 # Decisions
 
+## 2026-08-20 – The browser is LibreWolf from nixpkgs, not a self-packaged Waterfox
+
+- **Who**: Dominik, ClaudeCode
+- **Why**: A rebuilt desktop had no browser at all — nothing in the package set
+  provided one, while Arch installs `waterfox-bin`. nixpkgs has no `waterfox`
+  attribute (checked against the pinned revision, with `firefox` resolving in
+  the same package set as a control), so matching Arch meant packaging it here.
+- **Tradeoffs**: (1) **Waterfox from elsewhere** — the one community flake,
+  `sammypanda/nixos-waterfox`, is a single commit whose README says "Currently
+  broken?". Flathub's `net.waterfox.waterfox` tracks releases itself but carries
+  no verified badge (the listing reads "Medium Risk"), needs the Flatpak stack,
+  and a NixOS Discourse thread reports crashes and system freezes with that
+  exact package. Both rejected. (2) **Waterfox packaged here** — this was built
+  and it worked: the upstream tarball plus `autoPatchelfHook`, `waterfox
+  --version` reporting 6.6.17, no missing library, and a SHA-512 identical to
+  the one the Arch package pins. It was then discarded on the maintenance
+  argument: version and hash are bumped by hand, `nix flake update` does not
+  move a plain tarball, and nothing signals a missed release. For `stasis` or
+  `sweet-cursors` that is irrelevant; for the most exposed program on the
+  machine it means silently running a browser with known holes. A version-check
+  script was offered as a mitigation and not taken. (3) **What replaces it** —
+  `librewolf` is in nixpkgs, so its bumps arrive with `nix flake update`, and it
+  is fully substitutable: 179.6 MiB fetched, nothing built locally
+  (`librewolf-bin` would build six derivations and was not taken). Firefox was
+  the other candidate; LibreWolf is closer to what Waterfox is for. The price is
+  stricter defaults — `resistFingerprinting`, clearing on shutdown, restricted
+  WebGL — which have to be relaxed by hand where they get in the way.
+- **How**: `librewolf` in `environment.systemPackages` in `modules/desktop.nix`.
+  `pkgs/waterfox.nix` is deleted rather than left lying around unused. The
+  browser therefore differs from Arch, which keeps `waterfox-bin`.
+
 ## 2026-08-20 – Printing is driverless, VPN gets its plugin, VLC replaces mpv
 
 - **Who**: Dominik, ClaudeCode

modules/desktop.nix

@@ -237,6 +237,10 @@ in
     moonarchPkgs.stasis
     moonarchPkgs.moonarch-scripts
 
+    # Browser. Arch runs waterfox-bin, which nixpkgs does not carry; see
+    # DECISIONS.md for why this is not packaged here.
+    librewolf
+
     # Session lock. The power menu is a Quickshell popout, not a package.
     swaylock