Install only the helper scripts that are still called

cpugov, sink-switcher and nightlight were referenced solely by the waybar
config; the Quickshell popouts cover all three. btnote, capsnote, vpn and
waybar-hidpp are unreferenced anywhere.

Adds the two system units for battery threshold restore and camera
shutoff, which had been missed.

modules/desktop.nix

@@ -1,5 +1,5 @@
-# ABOUTME: Deploys the Moonarch XDG configs and desktop package set.
-# ABOUTME: Counterpart to the package() function in moonarch-git/PKGBUILD.
+# ABOUTME: Deploys the XDG configs from the moonarch repo and the package set.
+# ABOUTME: Niri, Quickshell, terminal, theming, portals.
 
 { pkgs, lib, moonarchSrc, moonarchPkgs, ... }:
 
@@ -7,8 +7,6 @@ let
   xdg = "${moonarchSrc}/defaults/xdg";
   etc = "${moonarchSrc}/defaults/etc";
 
-  # The moonarch-* helper scripts from defaults/bin, installed as a single
-  # package. Counterpart to `install -Dm755 defaults/bin/moonarch-* -t /usr/bin/`.
   # waypaper calls `swww`/`swww-daemon`, but the maintained successor ships as
   # `awww`. Same compatibility symlinks the Arch package creates.
   swww-compat = pkgs.runCommand "swww-compat" { } ''
@@ -25,28 +23,6 @@ let
     substitute ${xdg}/waypaper/config.ini "$out" \
       --replace-fail /usr/share/moonarch/wallpaper.jpg ${wallpaper}
   '';
-
-  moonarch-scripts = pkgs.stdenv.mkDerivation {
-    pname = "moonarch-scripts";
-    version = "0-unstable";
-    src = moonarchSrc;
-
-    dontBuild = true;
-    installPhase = ''
-      runHook preInstall
-      # moonarch-waybar* are excluded: waybar is not part of this setup, the
-      # Quickshell bar replaced it.
-      for f in defaults/bin/moonarch-*; do
-        case "$(basename "$f")" in
-          moonarch-waybar*) continue ;;
-        esac
-        install -Dm755 "$f" -t "$out/bin/"
-      done
-      runHook postInstall
-    '';
-
-    meta.description = "Moonarch helper scripts for Waybar, power and devices";
-  };
 in
 {
   # --- XDG configs -> /etc/xdg/ ---
@@ -54,8 +30,7 @@ in
   # Deployed verbatim from the moonarch repo; defaults/ stays the single
   # source of truth for both distros.
   #
-  # Deliberately excluded: defaults/xdg/walker/ — walker is not part of this
-  # setup, the Quickshell launcher replaced it.
+  # defaults/xdg/walker/ is not deployed: the Quickshell launcher covers it.
   environment.etc = {
     # niri reads /etc/niri, not /etc/xdg/niri. Both are provided: the former
     # is what niri actually loads, the latter keeps the layout consistent with
@@ -172,12 +147,12 @@ in
   ];
 
   environment.systemPackages = with pkgs; [
-    # Moonarch's own programs
+    # Own programs
     moonarchPkgs.moonlock
     moonarchPkgs.moonset
     moonarchPkgs.sweet-cursors
     moonarchPkgs.stasis
-    moonarch-scripts
+    moonarchPkgs.moonarch-scripts
 
     # Compositor extras
     xwayland-satellite

modules/services.nix

@@ -1,5 +1,5 @@
-# ABOUTME: systemd user and system services for the Moonarch session.
-# ABOUTME: Rebuilt from defaults/etc/systemd/ because the units use FHS paths.
+# ABOUTME: systemd system and user services for the desktop session.
+# ABOUTME: Rebuilt from moonarch/defaults/etc/systemd/, whose units use FHS paths.
 
 { pkgs, lib, moonarchPkgs, ... }:
 
@@ -45,6 +45,52 @@
     };
   };
 
+  # --- System services from defaults/etc/systemd/system/ ---
+  #
+  # Rebuilt rather than copied, same reason as the user units: the originals
+  # reference /usr/bin.
+
+  systemd.services.moonarch-batsaver = {
+    description = "Restore battery conservation mode threshold";
+    after = [ "sysinit.target" ];
+    wantedBy = [ "multi-user.target" ];
+    unitConfig.ConditionPathExists = [
+      "/sys/class/power_supply/BAT0/charge_control_end_threshold"
+      "/var/lib/moonarch/batsaver-threshold"
+    ];
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = "${moonarchPkgs.moonarch-scripts}/bin/moonarch-batsaver-restore";
+      NoNewPrivileges = true;
+      ProtectHome = true;
+      PrivateTmp = true;
+      ProtectKernelModules = true;
+      ProtectControlGroups = true;
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      LockPersonality = true;
+    };
+  };
+
+  systemd.services.moonarch-camera = {
+    description = "Switch off all cameras on boot";
+    after = [ "sysinit.target" ];
+    wantedBy = [ "multi-user.target" ];
+    unitConfig.ConditionPathExistsGlob = "/sys/class/video4linux/video*";
+    serviceConfig = {
+      Type = "oneshot";
+      ExecStart = "${moonarchPkgs.moonarch-scripts}/bin/moonarch-camera-boot";
+      NoNewPrivileges = true;
+      ProtectHome = true;
+      PrivateTmp = true;
+      ProtectKernelModules = true;
+      ProtectControlGroups = true;
+      RestrictNamespaces = true;
+      RestrictRealtime = true;
+      LockPersonality = true;
+    };
+  };
+
   # Upstream ships a unit in the Arch package but not in the tarball, so it is
   # declared here. Mirrors /usr/lib/systemd/user/stasis.service.
   systemd.user.services.stasis = {
@@ -89,7 +135,7 @@
 
   # Night light stays disabled by default: it is a user toggle. Enabling it
   # here would create a system-scope symlink that overrides any
-  # `systemctl --user disable` — same reasoning as in moonarch-git/PKGBUILD.
+  # `systemctl --user disable`.
   systemd.user.services.wlsunset = {
     description = "Wlsunset night light (blue light filter)";
     partOf = [ "graphical-session.target" ];