Install helper scripts from any crate's scripts/ dir

Scripts were only picked up from cce-compositor/scripts, so a script
about another crate's code had nowhere versioned to live: cce-display-
manager's keyring self-test would have sat unversioned in ~/.local/bin
and been lost on a fresh clone — the same failure the .desktop entries
had until yesterday. crate_scripts() discovers <crate>/scripts/* and
installs it with the same per-package filtering as units and desktop
entries, so a per-crate 'make install' still installs only its own.

Co-Authored-By: Claude Fable 5 <[email protected]>

 CLAUDE.md        |  7 +++++++
 scripts/ccebuild | 36 ++++++++++++++++++++++++------------
 2 files changed, 31 insertions(+), 12 deletions(-)

diff --git a/CLAUDE.md b/CLAUDE.md
index 0c4c135..53c2c77 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -71,6 +71,13 @@ It also installs the **`.desktop` entries** crates ship at their own root into
 in `~/.local/share/applications` until 2026-08-16; see `./WORKSPACE.md` for the
 `Exec=`/`MimeType=` rules that go with them.
 
+**Helper scripts** are installed from **any** crate's `scripts/` dir, not just
+this one's (`crate_scripts()`, same per-package filtering). A script belongs in
+the repo whose code it is about — `cce-keyring-selftest` reports on the keyring
+chain, so it ships from `cce-display-manager/scripts/` — and anything installed
+from outside a repo is unversioned and gone on a fresh clone, which is how that
+script and the `.desktop` entries above both started out.
+
 `ccebuild restart` deliberately cannot reach the compositor: `cce-fx` is not a user
 unit (startcce launches it), and restarting it would tear down the session.
 
diff --git a/scripts/ccebuild b/scripts/ccebuild
index a2bd595..b7bb713 100755
--- a/scripts/ccebuild
+++ b/scripts/ccebuild
@@ -95,6 +95,17 @@ user_units() {
           done
 }
 
+# Helper scripts a crate ships in its own scripts/ dir. Not just this crate's:
+# a script belongs in the repo whose code it is about (cce-keyring-selftest
+# reports on the keyring chain, so it lives with it in cce-display-manager), and
+# anything installed from outside a repo is unversioned and lost on a fresh
+# clone. Units are excluded here — user_units() installs those, to a different
+# directory — and .desktop entries never live here.
+crate_scripts() {
+    find "$WS" -mindepth 3 -maxdepth 3 -path '*/scripts/*' -type f \
+        -not -path "$WS/target/*" 2>/dev/null
+}
+
 # XDG .desktop entries shipped by crates, at the crate root next to Cargo.toml.
 #
 # These used to be hand-written straight into ~/.local/share/applications, which
@@ -166,18 +177,19 @@ cmd_install() {
         ln -sf cce-fx "$BINDIR/cce"
     fi
 
-    # Helper scripts live in cce-compositor; only install them when that crate is
-    # in scope (i.e. a full install, or an explicit cce-fx install).
-    if [ ${#pkgs[@]} -eq 0 ] || [[ " ${pkgs[*]} " == *" cce-fx "* ]]; then
-        printf '==> installing helper scripts\n'
-        local s
-        for s in "$WS"/cce-compositor/scripts/*; do
-            [ -f "$s" ] || continue
-            case "$s" in *.service) continue ;; esac
-            install -m 755 "$s" "$BINDIR/$(basename "$s")"
-            n=$((n + 1))
-        done
-    fi
+    local s scripts=0
+    while read -r s; do
+        [ -n "$s" ] || continue
+        case "$s" in *.service) continue ;; esac
+        # Same filtered install as the units and desktop entries below.
+        if [ ${#pkgs[@]} -gt 0 ]; then
+            crate_selected "$(file_crate_dir "$s")" "${pkgs[@]}" || continue
+        fi
+        [ "$scripts" -eq 0 ] && printf '==> installing helper scripts -> %s\n' "$BINDIR"
+        install -m 755 "$s" "$BINDIR/$(basename "$s")"
+        scripts=$((scripts + 1))
+        n=$((n + 1))
+    done < <(crate_scripts)
 
     local u units=0
     while read -r u; do