feat(desktop): workstation polish pack (apparmor, kernel panic, hyprpicker)

agent/BACKLOG.md

@@ -302,15 +302,6 @@ implement. Bernardo moves accepted items into a tier.*
 
 
 
-- **[security] System-wide AppArmor confinement**:
-  Enabling `security.apparmor.enable = true` tightens the security posture of the workstation. It confines services and applications to their minimum necessary privileges, shielding the system against zero-days in desktop apps (like PDF viewers or media players). The cost is low (a single NixOS toggle that pulls in the default profile set), and it provides a critical layer of defense-in-depth for a daily-driver workstation.
-
-- **[usefulness] Wayland-native color picker (`hyprpicker`)**:
-  Designers and developers constantly need to sample colors from the screen. Adding `hyprpicker` and binding it to a keyboard shortcut (e.g., `SUPER+SHIFT+C`) gives a fast, Wayland-native magnifying glass color picker that freezes the screen and copies the hex code directly to the clipboard.
-
-- **[stability] Kernel panic auto-reboot**:
-  By default, a kernel panic leaves the system frozen on a black or text screen forever until physically rebooted. Setting `boot.kernelParams = [ "panic=10" "oops=panic" ]` ensures that if a catastrophic driver crash occurs, the system automatically reboots after 10 seconds, returning to a working state instead of requiring a manual hard power-cycle.
-
 ## Decisions `[human]`
 
 Open calls only Bernardo can make; agents add options/evidence but never