Complete the desktop: default apps, mDNS, firewall, zram, fonts

Wire up features that were half-shipped and add sensible resilience
defaults:

- mimeapps.list in skel: images->loupe, A/V->vlc, text->gnome-text-editor,
  pdf/html->zen, archives->file-roller, dirs->nautilus (so opening a file
  from nautilus actually does something)
- avahi + nss-mdns: CUPS network-printer discovery + .local resolution
  (enable avahi-daemon; insert mdns_minimal into nsswitch hosts:)
- ufw: deny-incoming firewall, mDNS (5353/udp) allowed so discovery still
  works; enabled in post-install
- zram-generator: compressed RAM swap (half RAM capped 4 GiB, zstd)
- fwupd + reflector.timer: firmware updates and periodic mirror refresh
- fonts: ttf-liberation (Office/web metric compat), ttf-dejavu, font-awesome

iso/packages.x86_64

@@ -75,6 +75,11 @@ pipewire-jack
 networkmanager
 network-manager-applet
 iw
+# mDNS service/name resolution — lets CUPS auto-discover network printers and
+# resolves .local hostnames (avahi-daemon enabled + nss-mdns wired in
+# post-install.sh).
+avahi
+nss-mdns
 # Wi-Fi backend for NetworkManager (its default; no extra config needed).
 wpa_supplicant
 bluez
@@ -107,6 +112,11 @@ noto-fonts-emoji
 ttf-jetbrains-mono
 # Nerd font variant — icons in terminal tools (eza --icons, fastfetch, yazi)
 ttf-jetbrains-mono-nerd
+# Metric-compatible (Arial/Times/Courier) so Office/web docs lay out correctly,
+# broad Unicode fallback, and the Font Awesome icon glyph set.
+ttf-liberation
+ttf-dejavu
+ttf-font-awesome
 
 # Terminal
 kitty
@@ -236,6 +246,14 @@ system-config-printer
 # remote post-install (needs network); the runtime is shipped ready.
 flatpak
 
+# Firewall — ufw, enabled deny-incoming in post-install.sh (mDNS allowed so
+# printer discovery still works).
+ufw
+# Firmware updates via LVFS (works with gnome-software / fwupdmgr).
+fwupd
+# Compressed RAM swap — see /etc/systemd/zram-generator.conf.
+zram-generator
+
 # Icon and cursor themes
 # Papirus-Dark: cohesive icon set used as the BOS default (set via gsettings in
 # hyprland.lua autostart and in skel gtk-3.0/settings.ini).