[feat] Restore upstream's CJK font and fcitx5, add Traditional Chinese

[k5953837]

Fixes #175.

Summary

The factory guest cannot display or type Traditional Chinese. It generates only
en_US.UTF-8, ships no CJK font, and omits fcitx5, so Chinese renders as tofu
boxes with no way to enter it.

Most of what is missing was never Omarchy's decision. At the pinned release
(4.0.2, 346e69e1c), install/omarchy-base.packages already contains:

35: fcitx5
36: fcitx5-gtk
37: fcitx5-qt
88: noto-fonts-cjk

guest/packages.txt — the intentionally trimmed ARM64 transaction — drops all
four. This restores them, adds fcitx5-chewing for Bopomofo, and supplies the
Traditional-Chinese-specific configuration upstream does not: a zh_TW.UTF-8
locale, a fontconfig rule that picks TC Han glyph variants over Simplified or
Japanese ones, and a way to choose the language.

That trim has already cost one bug: #91, where the omitted fcitx5 binary left
upstream's omarchy-fcitx5.service in a 203/EXEC restart loop. The
ConditionPathExists=/usr/bin/fcitx5 drop-in added in #106 is self-healing —
installing the package makes it pass with no change to the guard.

What changes

Concern	Change
Packages	Restore noto-fonts-cjk, fcitx5, fcitx5-gtk, fcitx5-qt; add fcitx5-chewing
Locale	Generate zh_TW.UTF-8 alongside en_US.UTF-8 in configure-rootfs.sh
Glyph variants	New etc/fonts/conf.d/30-try-omarchy.conf preferring Noto Sans/Serif/Mono CJK TC for zh-tw and zh-hant
Input method	Seed /etc/skel/.config/fcitx5/profile with keyboard-us first, chewing second
XWayland	XMODIFIERS=@im=fcitx in environment.d
Chromium	Append --enable-wayland-ime to upstream's /etc/skel/.config/chromium-flags.conf
Choosing it	A Language row in the start menu, in the shape the other integrations already use

How the choice reaches the guest

The Language row stores a preference the same way Shared folder, Port forwarding
and Resources do, run-qemu-gpu.sh turns it into a tryomarchy.locale= kernel
argument the way it already derives tryomarchy.ssh_access=1, and a guest
oneshot unit writes /etc/locale.conf before either login entry point starts.

Leaving the row alone emits no environment variable and no kernel argument, so
an English launch is byte-identical to today. Both sides validate the value
against the locales the image actually generates; the host fails loudly on an
unknown one because that value comes from our own code, while the guest ignores
it silently because the kernel command line does not deserve that trust.

Beyond #175

#175 proposed the guest-side restore only. The Language row is not in it. I
added it because the guest half alone leaves a user with a working locale and no
way to select it short of editing /etc/locale.conf by hand, and because it
needed no new mechanism — it is the same preference → OMARCHY_QEMU_GPU_* →
kernel-argument path three existing settings already take. Happy to split it out
if you would rather see the packages land on their own.

Deliberately excluded

• fcitx5-chinese-addons — hard-depends on qt6-webengine, which does not
  fit the 6144 MiB image. Add Chinese input and locale to the factory guest #63 hit the same wall. Bopomofo via fcitx5-chewing
  does not need it.
• fcitx5-configtool — upstream does not ship it either, and it pulls a KDE
  dependency chain for a GUI the seeded profile makes unnecessary.
• Raising image.sizeMiB — that value is duplicated as a runtime contract in
  run-qemu-gpu.sh and asserted in run-qemu-ssh-contract.test.sh; changing it
  is an architecture discussion, not part of this.
• Translating Omarchy's own interface — the setup wizard and menus stay
  English, and README says so. Upstream has no translation mechanism; those
  strings are hardcoded in its shell scripts.

On the two earlier attempts

#26 and #63 both proposed Simplified Chinese and were closed by their own
authors. The only maintainer feedback on either was on #26:

Thanks for pushing this! Before merge, please update the package lock so it
includes the new packages and builds don't fail.

That PR bumped requestedFileSha256 without a real resolve. This one's lock is
a genuine refresh: nine resolved entries, no existing version touched.

Validation

Package lock — regenerated with guest/build-container.sh --refresh-package-lock
against current main, not carried over from an earlier branch. The diff is nine
additions, zero removals, and no change to any existing version:

enchant · fcitx5 · fcitx5-chewing · fcitx5-gtk · fcitx5-qt ·
libchewing · noto-fonts-cjk · xcb-imdkit · yoga

Five are requested in packages.txt; the other four are transitive
(libchewing for the Chewing engine, xcb-imdkit for fcitx5-qt's XCB input
method, enchant and yoga via fcitx5).

Tests — ./guest/test passes: 110 Python tests including eight new
test_locale.py cases (allowlist parity, symlink refusal, shell-metacharacter
payloads, idempotency), plus the native guest contract with the new zh-TW
assertions. swift test passes 254 tests including eleven new pure-model cases
for the preference store and menu presentation.

Image — make guest completes and the packed root sits at 82.97% of the
6144 MiB budget, inside pack-image.sh's 85% ceiling.

Booted — built the image, chose Traditional Chinese in the start menu, and
ran a disposable VM through first-boot provisioning on an Apple Silicon Mac. In
the guest:

$ echo "LANG=[$LANG]"; cat /etc/locale.conf; systemctl is-active try-omarchy-locale.service
LANG=[zh_TW.UTF-8]
LANG=zh_TW.UTF-8
active

xdg-user-dirs renamed the home directories (桌面, 下載, 文件, 音樂, 圖片, 影片,
專案), eza printed dates as 11 9月 02:09, and every glyph rendered — no tofu.
Ctrl+Space reached Chewing and su3 cl3 committed 你好, after which
Ctrl+Space returned to plain US input:

$ echo 你好 from omarchy zh-TW
你好 from omarchy zh-TW

Leaving the Language row alone emits no kernel argument; /etc/locale.conf then
gets the image default, which is also what makes switching back to English take
effect on a VM that has already run in Chinese.

---

🤖 Generated with Claude Code

[k5953837]

CI is sitting at action_required — this is my first PR here, so the workflow
needs your approval before it runs. Nothing to fix on my end; flagging it so it
does not look like a stuck check.

For what it is worth, make test passes locally on macOS 15 / Apple Silicon:
./guest/test is clean (110 Python tests, native guest contract verified), and
swift test passes 254 tests. The one exception is
StartMenuWindowWidthTests.swift:131, which expects content.bounds.width == 600
and gets 601.0 — it fails identically on a clean main checkout in this
environment, and CI has it passing on main, so it reads as a local font-metric
artifact rather than anything this branch touches.