Fix prod-readiness issues flagged in audit

- Fix XDG config dir logic in config/mod.rs (was double-nesting and had /home/user hardcode)
- Replace /home/user hardcodes in breadbar.rs and hyprland.rs with config::config_dir()
- Fix /home/user hardcode in packages.rs (uses /root fallback for .local/state path)
- Remove eprintln! from GTK callback in packages.rs (no stderr at runtime)
- Fix YAML parse error in branding.desc (missing space after sidebarTextHighlight key)
- Add .gitignore (Rust target/, ISO artifacts, editor/OS junk, secrets)
- Delete state.rs (dead code — never mod'd in main.rs)
- Add brightnessctl, grim, slurp to packages.x86_64 (used by keybinds)
- Rename can-you-begin-a-composed-beacon.md → DESIGN.md

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

bos-settings/src/config/mod.rs

@@ -15,10 +15,13 @@ pub fn save<T: serde::Serialize>(path: &Path, val: &T) -> Result<(), Box<dyn Err
 }
 
 pub fn config_dir() -> PathBuf {
-    let home = std::env::var("HOME").unwrap_or_else(|_| {
-        std::env::var("XDG_CONFIG_HOME")
-            .map(|p| PathBuf::from(p).parent().unwrap_or(Path::new("/")).to_string_lossy().to_string())
-            .unwrap_or_else(|_| "/home/user".to_string())
-    });
+    // Honour XDG_CONFIG_HOME if set; otherwise fall back to $HOME/.config.
+    if let Ok(xdg) = std::env::var("XDG_CONFIG_HOME") {
+        let p = PathBuf::from(xdg);
+        if p.is_absolute() {
+            return p;
+        }
+    }
+    let home = std::env::var("HOME").unwrap_or_else(|_| "/root".to_string());
     PathBuf::from(home).join(".config")
 }

bos-settings/src/state.rs

@@ -1,11 +0,0 @@
-pub struct AppState {
-    pub current_view: String,
-}
-
-impl AppState {
-    pub fn new() -> Self {
-        Self {
-            current_view: "snapshots".to_string(),
-        }
-    }
-}

bos-settings/src/ui/views/breadbar.rs

@@ -3,10 +3,10 @@ use gtk4::{Box as GBox, Button, Label, Orientation, ScrolledWindow, TextView};
 use std::path::PathBuf;
 
 fn css_path() -> PathBuf {
-    let home = std::env::var("HOME").unwrap_or_else(|_| "/home/user".to_string());
-    PathBuf::from(home).join(".config/breadbar/style.css")
+    crate::config::config_dir().join("breadbar/style.css")
 }
 
+
 pub fn build() -> GBox {
     let path = css_path();
     let existing_css = std::fs::read_to_string(&path).unwrap_or_default();

bos-settings/src/ui/views/hyprland.rs

@@ -23,8 +23,7 @@ fn get_monitors() -> Vec<String> {
 }
 
 fn hypr_path(name: &str) -> std::path::PathBuf {
-    let home = std::env::var("HOME").unwrap_or_else(|_| "/home/user".to_string());
-    std::path::PathBuf::from(home).join(".config/hypr").join(name)
+    crate::config::config_dir().join("hypr").join(name)
 }
 
 pub fn build() -> GBox {

bos-settings/src/ui/views/packages.rs

@@ -8,7 +8,7 @@ use std::io::{BufRead, BufReader};
 use std::process::{Command, Stdio};
 
 fn read_installed() -> HashMap<String, String> {
-    let home = std::env::var("HOME").unwrap_or_else(|_| "/home/user".to_string());
+    let home = std::env::var("HOME").unwrap_or_else(|_| "/root".to_string());
     let path = std::path::Path::new(&home)
         .join(".local/state/bakery/installed.json");
 
@@ -132,7 +132,7 @@ pub fn build() -> GBox {
                     Ok(mut child) => {
                         std::thread::spawn(move || { let _ = child.wait(); });
                     }
-                    Err(e) => eprintln!("bakery update failed: {e}"),
+                    Err(_) => {}  // bakery not found; button is a no-op
                 }
             });