Start user units immediately in first-run, not just enable

systemctl --user enable only writes the .wants symlinks; the services
don't actually run until next login. Switching to --now enables AND
starts them, so the first session has bt-agent (bluetooth pairing) and
omarchy-sleep-lock active immediately rather than waiting a reboot.

omarchy-recover-internal-monitor is Type=oneshot with a
ConditionPathExists guard, so --now is harmless for it (it'll skip if
the toggle isn't set).

install/user/first-run/enable-user-units.sh

@@ -1,15 +1,17 @@
 #!/bin/bash
 
-# Enable the user systemd units we ship. Runs at first-run rather than at
-# finalize-user time because the user manager isn't live during the ISO
-# chroot — by first-run, the Hyprland/uwsm session is up and `systemctl
-# --user enable` writes the correct .wants symlinks based on each unit's
-# [Install]/WantedBy. ConditionPath* in the unit files keep the enabled
-# units inert on hardware they don't apply to.
+# Enable AND start the user systemd units we ship. Runs at first-run rather
+# than at finalize-user time because the user manager isn't live during the
+# ISO chroot — by first-run, the Hyprland/uwsm session is up and
+# `systemctl --user enable --now` both writes the correct .wants symlinks
+# (based on each unit's [Install]/WantedBy) and starts the services so the
+# first session has bluetooth pairing, sleep lock, etc. live immediately
+# instead of waiting for the next login. ConditionPath* in the unit files
+# keep the enabled units inert on hardware they don't apply to.
 
 set -euo pipefail
 
-systemctl --user enable \
+systemctl --user enable --now \
   bt-agent.service \
   omarchy-recover-internal-monitor.service \
   omarchy-sleep-lock.service