feat(desktop): workstation polish pack (apparmor, kernel panic, hyprpicker)

modules/nixos/default.nix

@@ -141,6 +141,14 @@ in
       notifications.x11.enable = lib.mkDefault true;
       notifications.wall.enable = lib.mkDefault true;
     };
+    # Core security: enable AppArmor to confine desktop apps and services.
+    security.apparmor.enable = true;
+    security.apparmor.killUnconfinedConfinables = false;
+
+    # Core stability: reboot automatically after 10s on a kernel panic
+    # (prevents the system from hanging indefinitely on a black screen).
+    boot.kernelParams = [ "panic=10" "oops=panic" ];
+
     # Explicitly enable systembus-notify to resolve a mkDefault conflict
     # between earlyoom (true) and smartd (false).
     services.systembus-notify.enable = true;