ccebuild install-system: enable units that opt in with X-CceEnable=yes

install-system copied system units but never enabled them, which was
fine for the udev-started cce-power-apply.service but leaves a unit
wanted by a sleep target inert. Enabling stays opt-in per unit, since
cce-display-manager.service must stay disabled. Document the resume
re-apply in the animations section of WORKSPACE.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

 WORKSPACE.md     |  5 ++++-
 scripts/ccebuild | 18 ++++++++++++++++++
 2 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/WORKSPACE.md b/WORKSPACE.md
index f180ce75..875cee95 100644
--- a/WORKSPACE.md
+++ b/WORKSPACE.md
@@ -385,7 +385,10 @@ still moves. Its source is **`/run/cce/animations`** (`on`/`off`, missing
 means on), written as root by `cce-power-apply` when the Power page's
 **Animations** lever is part of the mode that is running. It lives under
 /run, not `~/.config`, because the writer runs from udev with no session and
-no `$HOME`. `enabled()` re-reads it at most every 500 ms, so a plug or unplug
+no `$HOME`. It also runs after every wake (`cce-power-apply-resume.service`,
+which `ccebuild install-system` enables through its `X-CceEnable=yes` key),
+because the kernel's resume event for a charger plugged in during sleep is
+unreliable. `enabled()` re-reads it at most every 500 ms, so a plug or unplug
 reaches running clients and the compositor without a reload. Set
 `CCE_ANIMATIONS=0` (or `1`) to force it for one process, for testing.
 
diff --git a/scripts/ccebuild b/scripts/ccebuild
index e9e24633..5d8d0386 100755
--- a/scripts/ccebuild
+++ b/scripts/ccebuild
@@ -771,6 +771,24 @@ cmd_install_system() {
     done < <(system_units)
     if [ "$reload" -eq 1 ]; then queue systemctl daemon-reload; fi
 
+    # Enabling is opt-in per unit, with `X-CceEnable=yes` in its [Install]
+    # (systemd ignores X- keys). Most units here must not be enabled on
+    # install: cce-display-manager.service stays disabled because the
+    # template is what runs. But a unit wanted by a sleep target, like
+    # cce-power-apply-resume.service, does nothing until it is enabled, and
+    # an install that skipped that step would report success for a hook
+    # that never fires. Checked as the user (is-enabled needs no privilege),
+    # queued after the daemon-reload so a unit that is new in this run is
+    # already known.
+    local unit
+    while read -r file; do
+        grep -qE '^[[:space:]]*X-CceEnable[[:space:]]*=[[:space:]]*yes[[:space:]]*$' "$file" || continue
+        unit=$(basename "$file")
+        if systemctl is-enabled --quiet "$unit" 2>/dev/null; then continue; fi
+        printf '  enable %s\n' "$unit"
+        queue systemctl enable "$unit"
+    done < <(system_units)
+
     while read -r file; do
         dest="/etc/pam.d/$(basename "$file")"
         if [ -e "$dest" ] && cmp -s "$file" "$dest"; then continue; fi