feat(lock): install moonarch-lock and give it its own PATH

moonarch replaced its direct gtklock calls with the moonarch-lock
wrapper. stasis.rune and PowerPopout.qml come from moonarchSrc, so the
new command arrived here at once while the script did not -- the
moonarch-scripts whitelist did not carry it.

Wrapped rather than left bare like the other seven: it has two callers
and must not depend on either one's PATH. A missing gtklock means no
lock screen at all, a missing niri or jq only the wrong monitor.

modules/services.nix

@@ -269,7 +269,9 @@ in
       niri
       pulseaudio
       libnotify
-      gtklock
+      # moonarch-lock, not gtklock: the lock actions call the wrapper, which
+      # carries gtklock, niri and jq in its own PATH.
+      moonarchPkgs.moonarch-scripts
       brightnessctl
       systemd
     ];