Sync from upstream: runtime-stage $HOME check allows the pwsh profile

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/test_smoke.py

@@ -234,8 +234,11 @@ def test_desktop_stage_is_the_only_one_touching_home():
     the desktop stage. A test clone runs prep + runtime unconditionally."""
     script = (REPO_ROOT / "bin" / "restore-linux.sh").read_text()
     runtime = script.split('if [ "$stage" = "runtime" ]; then')[1].split("\n    exit 0\nfi")[0]
-    # The ncp/promethean shell aliases are the one deliberate exception - they're
-    # how you launch NexusOS at all, and both are grep-guarded no-ops on re-run.
+    # Shell wiring is the one deliberate exception: registering ncp in ~/.bashrc
+    # and in the PowerShell profile is how you launch NexusOS at all, and each is
+    # a grep-guarded no-op on re-run. Desktop config (xfconf, plank, themes,
+    # os-release) must stay in the desktop stage so --no-desktop really is safe.
+    shell_wiring = (".bashrc", "powershell/profile.ps1")
     home_writes = [ln for ln in runtime.splitlines()
-                   if "$HOME" in ln and ".bashrc" not in ln]
+                   if "$HOME" in ln and not any(w in ln for w in shell_wiring)]
     assert not home_writes, f"runtime stage writes to $HOME: {home_writes}"