install.sh cleanup: remove what steam-frame-nix wrote outside the Nix store

`install.sh cleanup [--dry-run] (--all | --orphans [--keep <artifact>]...)`
knows every file any version wrote outside the store and Home Manager's
links, removes only what is provably its own, prints every action and
reports everything else as "left alone"; a second run changes nothing.
Only bash, coreutils, findutils, grep, sed, awk and jq (all in /usr/bin on
SteamOS), so it also works piped from curl after a rollback or with Nix gone.

- SteamVR debugger: VRWebHelper.DebuggerEnabled is put back to its value
  from before (steamvr-debugger.armed; the old empty marker means "absent"
  and is migrated), only while SteamVR is stopped. While it runs, a runtime
  drop-in (/run/user/<uid>/systemd/user/steamvr.service.d) runs a /usr/bin-only
  restore script from /run/user/<uid>/steam-frame-nix when SteamVR stops.
- icon fallback links into Breeze and their manifest (dirs only if they
  held nothing else; hicolor's mtime bumped so Steam rescans).
- Firefox: the desktop profile's user.js link, older user.js links and
  marker-headed copies, and the values they left in prefs.js (only with the
  profile closed; deferred otherwise).
- Jellyfin: the hwdec shim entries in the Flatpak override (devices=all
  only when it came with them), an empty override file, the old shim copy.
- the dashboard patches' saved state: --all only; --orphans removes just
  stale *.json.tmp files.

`install.sh uninstall` runs `cleanup --all` before removing Home Manager
(replacing its own ui-patches removal) and names what is deferred;
`install.sh status` shows what `cleanup --all` would do. The flake exports
it as packages.<system>.cleanup / apps.cleanup
(`nix run github:lhns/steam-frame-nix#cleanup -- --all`), and
checks.cleanup runs it against fake home and runtime dirs: every artifact
next to look-alikes that aren't ours, --dry-run, second runs, SteamVR
running (deferral, restore script), the user's own debugger key.

flake.nix

@@ -34,18 +34,34 @@
       firefox = ./modules/firefox.nix;
       jellyfin = ./modules/jellyfin.nix;
     };
+    systems = [ "aarch64-linux" "x86_64-linux" ];
+    forSystems = f: nixpkgs.lib.genAttrs systems (system: f nixpkgs.legacyPackages.${system});
   in {
     homeManagerModules = modules // {
       default = { imports = builtins.attrValues modules; };
     };
 
+    # Removes what steam-frame-nix wrote outside the Nix store (install.sh
+    # cleanup): nix run github:lhns/steam-frame-nix#cleanup -- --all
+    packages = forSystems (pkgs: {
+      cleanup = pkgs.callPackage ./modules/cleanup/package.nix { };
+    });
+    apps = nixpkgs.lib.mapAttrs (_: p: {
+      cleanup = {
+        type = "app";
+        program = "${p.cleanup}/bin/steam-frame-nix-cleanup";
+        meta.description = "Remove what steam-frame-nix wrote outside the Nix store";
+      };
+    }) self.packages;
+
     # Tests of the VR keyboard (text model, corrector, swipe decoder on the
-    # default German + English dictionary) and of the Jellyfin mpv shim:
-    # nix flake check
-    checks = nixpkgs.lib.genAttrs [ "aarch64-linux" "x86_64-linux" ] (system: {
-      jellyfin = import ./modules/jellyfin/check.nix { pkgs = nixpkgs.legacyPackages.${system}; };
+    # default German + English dictionary), the Jellyfin mpv shim and
+    # install.sh cleanup: nix flake check
+    checks = forSystems (pkgs: {
+      cleanup = import ./modules/cleanup/check.nix { inherit pkgs; };
+      jellyfin = import ./modules/jellyfin/check.nix { inherit pkgs; };
       vr-keyboard = (import ./modules/vr-keyboard/build.nix {
-        pkgs = nixpkgs.legacyPackages.${system};
+        inherit pkgs;
         dictionary = {
           languages = map (l: l // { keepFrequentAbove = 4.0; }) [
             { language = "de"; hunspell = "de_DE"; words = 60000; frequencyOffset = 0.0; }