feat(lock): install moonarch-lock and give it its own PATH

moonarch replaced its direct gtklock calls with the moonarch-lock
wrapper. stasis.rune and PowerPopout.qml come from moonarchSrc, so the
new command arrived here at once while the script did not -- the
moonarch-scripts whitelist did not carry it.

Wrapped rather than left bare like the other seven: it has two callers
and must not depend on either one's PATH. A missing gtklock means no
lock screen at all, a missing niri or jq only the wrong monitor.

DECISIONS.md

@@ -1,5 +1,12 @@
 # Decisions
 
+## 2026-09-14 – moonarch-lock follows moonarch; the wrapper needs a PATH of its own
+
+- **Who**: Dominik, ClaudeCode
+- **Why**: moonarch replaced the direct `gtklock` calls with `defaults/bin/moonarch-lock`, a wrapper that passes the focused output as `-M` so the lock screen's input form lands on the monitor the user is at (rationale: `moonarch/DECISIONS.md` 2026-09-14). Both files carrying those calls — `stasis/stasis.rune` and `PowerPopout.qml` — come from `moonarchSrc` and are deployed here unchanged, so the new command arrived on NixOS immediately while the script did not: `pkgs/moonarch-scripts.nix` installs an explicit whitelist, and `moonarch-lock` was not on it. The failure would have been silent in exactly the way `modules/services.nix` already warns about — stasis logs the action as started, sees the immediate exit and stops there, the same shape as the swaylock outage.
+- **Tradeoffs**: (1) **Wrapped, unlike the other seven scripts.** They reach their tools through whatever starts them; `moonarch-lock` has two callers (the stasis unit and Quickshell) and must not depend on either one's PATH. Its three dependencies are not equal in weight: a missing `gtklock` means no lock screen at all, a missing `niri` or `jq` only the wrong monitor, since the script falls back to plain gtklock. That asymmetry is what makes `makeWrapper` worth breaking the pattern for. (2) **`gtklock` leaves the stasis unit's `path`.** The wrapper carries it now, and naming it twice would leave two places to keep in step. (3) **No `substitute` on `stasis.rune`.** The 2026-09-11 rewrite of `swaylock`→`gtklock` is gone — moonarch names the same command this repo wants, so the file is copied as it is. That stays true only as long as the wrapper keeps its name on both distributions.
+- **How**: `pkgs/moonarch-scripts.nix` gains `moonarch-lock` in `scripts`, `makeWrapper` in `nativeBuildInputs`, and a `wrapProgram` prefixing `gtklock niri jq` onto PATH; its arguments resolve through the existing `callPackage`, so `flake.nix` is unchanged. `modules/services.nix`: `gtklock` in the stasis unit's `path` gives way to `moonarchPkgs.moonarch-scripts`. `README.md`'s deployment table no longer claims a rewrite for `stasis.rune`.
+
 ## 2026-09-11 – gtklock replaces swaylock; GTK theme moves from Frappé to Mocha
 
 - **Who**: Dominik, ClaudeCode

README.md

@@ -269,7 +269,7 @@ NixOS module owns the destination:
 |---|---|
 | `greetd/regreet.toml`, `regreet.css` | written by `services.displayManager.regreet` from module options; the wallpaper points at the store path |
 | `gtklock/config.ini` | generated, not copied: background and module paths are store paths. Deployed to `/etc/xdg`, which gtklock reads — no `$HOME` seed |
-| `stasis/stasis.rune` | `swaylock` rewritten to `gtklock` in the four action lines, then seeded into `$HOME` |
+| `stasis/stasis.rune` | copied unchanged and seeded into `$HOME`; its four action lines name `moonarch-lock`, which `moonarch-scripts` installs |
 | `waypaper/config.ini` | wallpaper path, rewritten and seeded into `$HOME` |
 | fontconfig defaults | `/etc/fonts/conf.d` is owned by the NixOS module |
 

modules/services.nix

@@ -269,7 +269,9 @@ in
       niri
       pulseaudio
       libnotify
-      gtklock
+      # moonarch-lock, not gtklock: the lock actions call the wrapper, which
+      # carries gtklock, niri and jq in its own PATH.
+      moonarchPkgs.moonarch-scripts
       brightnessctl
       systemd
     ];

pkgs/moonarch-scripts.nix

@@ -1,7 +1,7 @@
-# ABOUTME: Helper scripts for battery conservation and camera control.
+# ABOUTME: Helper scripts for battery conservation, camera control and the lock screen.
 # ABOUTME: Installs the subset of moonarch/defaults/bin that is still called.
 
-{ lib, stdenvNoCC, src }:
+{ lib, stdenvNoCC, makeWrapper, gtklock, niri, jq, src }:
 
 let
   # Only the scripts something still calls. The rest of defaults/bin is either
@@ -16,6 +16,7 @@ let
     "moonarch-camera-boot" # called by moonarch-camera.service
     "moonarch-camera-list" # called by CameraService.qml
     "moonarch-camera-toggle" # called by CameraService.qml
+    "moonarch-lock" # called by stasis.rune and PowerPopout.qml
   ];
 in
 stdenvNoCC.mkDerivation {
@@ -23,12 +24,22 @@ stdenvNoCC.mkDerivation {
   version = "0-unstable";
   inherit src;
 
+  nativeBuildInputs = [ makeWrapper ];
+
   dontBuild = true;
   dontConfigure = true;
 
   installPhase = ''
     runHook preInstall
     install -Dm755 ${lib.concatMapStringsSep " " (s: "defaults/bin/${s}") scripts} -t "$out/bin/"
+
+    # moonarch-lock is the one script here with hard runtime dependencies of its
+    # own. The others reach their tools through the unit or shell that starts
+    # them; this one is started from two places (the stasis unit and Quickshell)
+    # and must not depend on either one's PATH. A missing gtklock would mean no
+    # lock screen at all, a missing niri or jq the wrong monitor.
+    wrapProgram "$out/bin/moonarch-lock" \
+      --prefix PATH : ${lib.makeBinPath [ gtklock niri jq ]}
     runHook postInstall
   '';