#1164 feat(packages): add GNOME desktop apps for isDesktop

Summary

GNOME desktop apps

Adds 10 GNOME desktop apps to the isDesktop package list:
baobab, celluloid, cheese, eog, file-roller, gedit, gthumb, loupe, seahorse, shotwell

GNOME Keyring auto-unlock via TPM2 (fingerprint-compatible)

Enables fully automatic GNOME Keyring unlock at login — including fingerprint auth — using a TPM2+host-bound systemd-creds credential.

Why not gnome-keyring-daemon --unlock? In v48+ it ignores GNOME_KEYRING_CONTROL and always spawns a fresh instance. Instead, a Python script speaks the control socket protocol directly ($XDG_RUNTIME_DIR/keyring/control): credentials byte + big-endian [oplen][op=1][pwlen][password], reads [8][result].

Architecture:

• System service (systemd.services) with User=skakinoki — system manager handles TPM decryption, then drops to user
• LoadCredentialEncrypted from /etc/credstore.encrypted/gnome-keyring.cred
• pam_gnome_keyring still handles password logins via PAM; this service covers fingerprint logins

One-time setup (see named-hosts/matic/README.md):

sudo bash -c 'mkdir -p /etc/credstore.encrypted && \
  systemd-ask-password "Keyring password:" | \
  systemd-creds encrypt --name=gnome-keyring --with-key=tpm2+host \
  - /etc/credstore.encrypted/gnome-keyring.cred'

Test plan

• make build && make switch succeeds
• GNOME apps launch correctly on desktop
• After setup: sudo systemctl restart gnome-keyring-unlock.service logs gnome-keyring unlock: OK
• After reboot with fingerprint login: no keyring password prompt

🤖 Generated with Claude Code