feat: replace openbox with XFCE4 + Plank desktop stack

Dockerfile

@@ -4,7 +4,11 @@ SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 
 ENV DEBIAN_FRONTEND=noninteractive
 ENV EDITOR=nvim \
-    VISUAL=nvim
+    VISUAL=nvim \
+    XDG_CONFIG_HOME=/home/node/.config \
+    XDG_CACHE_HOME=/home/node/.cache \
+    XDG_DATA_HOME=/home/node/.local/share \
+    XDG_STATE_HOME=/home/node/.local/state
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
     ca-certificates \
@@ -42,7 +46,6 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     neovim \
     nodejs \
     novnc \
-    openbox \
     openssh-server \
     pipx \
     procps \
@@ -67,8 +70,39 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     x11-xserver-utils \
     x11vnc \
     xauth \
-    xterm \
     xvfb \
+    xfce4-session \
+    xfwm4 \
+    xfdesktop4 \
+    xfce4-settings \
+    xfce4-terminal \
+    thunar \
+    plank \
+    autocutsel \
+    greybird-gtk-theme \
+    elementary-xfce-icon-theme \
+    fonts-noto-core \
+    fonts-noto-color-emoji \
+    dbus-user-session \
+    xclip \
+  && rm -rf /var/lib/apt/lists/*
+
+# Chromium: Ubuntu 24.04 only ships a snap stub, so pull the real .deb from
+# the Debian Sid repo (pinned low so it only satisfies chromium itself).
+RUN printf '%s\n' \
+      "deb [arch=amd64] http://deb.debian.org/debian sid main" \
+      >/etc/apt/sources.list.d/debian-sid.list \
+  && printf '%s\n' \
+      "Package: *"            \
+      "Pin: release a=unstable" \
+      "Pin-Priority: 10"       \
+      ""                        \
+      "Package: chromium chromium-common chromium-sandbox" \
+      "Pin: release a=unstable" \
+      "Pin-Priority: 500"      \
+      >/etc/apt/preferences.d/chromium \
+  && apt-get update \
+  && apt-get install -y --no-install-recommends chromium \
   && rm -rf /var/lib/apt/lists/*
 
 RUN useradd --create-home --shell /bin/bash node \
@@ -84,6 +118,11 @@ RUN useradd --create-home --shell /bin/bash node \
   && ln -sf /usr/bin/nvim /usr/local/bin/vim \
   && ln -sf /usr/bin/nvim /usr/local/bin/vi
 
+COPY desktop/assets /opt/desktop/assets
+COPY desktop/xfce /opt/desktop/xfce
+COPY desktop/plank /opt/desktop/plank
+COPY desktop/scripts /opt/desktop/scripts
+
 COPY sshd_config /etc/ssh/sshd_config
 COPY microagent-init.sh /usr/local/bin/microagent-init
 COPY microagent-desktop-session.sh /usr/local/bin/microagent-desktop-session
@@ -95,6 +134,7 @@ COPY terminfo/xterm-ghostty.terminfo /tmp/xterm-ghostty.terminfo
 COPY terminfo/xterm-kitty.terminfo /tmp/xterm-kitty.terminfo
 
 RUN chmod 755 /usr/local/bin/microagent-init /usr/local/bin/microagent-desktop-session /usr/local/bin/microagent-network-up \
+  && chmod 755 /opt/desktop/scripts/apply-desktop-profile.sh \
   && chown node:node /home/node/.zshrc /home/node/.bashrc /home/node/.profile \
   && usermod -s /usr/bin/zsh node \
   && install -d /opt/zsh/pure \