zen: copy the real binary into the wrapper so autoconfig is read

wrapFirefox only copies the exe matching binaryName ("zen-beta"), but Gecko
execs lib/zen-bin-*/zen, a symlink into the unwrapped package. The app dir
resolved there, so mozilla.cfg and defaults/pref were never read.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

apps/zen.nix

@@ -100,7 +100,7 @@ in
 {
   config = lib.mkIf (lib.elem config.networking.hostName [ "FredOS-Gaming" "FredOS-Macbook" ]) {
     environment.systemPackages = [
-      (inputs.zen-browser.packages.${pkgs.stdenv.hostPlatform.system}.default.override {
+      ((inputs.zen-browser.packages.${pkgs.stdenv.hostPlatform.system}.default.override {
         # Lands in defaults/pref/autoconfig.js, the only place this pref is
         # read — setting it from mozilla.cfg is too late to unsandbox itself.
         extraAutoConfig = ''
@@ -108,7 +108,21 @@ in
           pref("fred.zenTheme.autoconfig", true);
         '';
         extraPrefs = themeHotReload;
-      })
+      }).overrideAttrs (old: {
+        # wrapFirefox copies the executable it knows by name so that Gecko,
+        # which derives its application directory from the binary's *resolved*
+        # path, lands in the wrapper's tree. It knows this one as "zen-beta"
+        # (binaryName), but the binary actually exec'd is lib/zen-bin-*/zen —
+        # left behind as a symlink into the unwrapped package. So the app dir
+        # resolved to the unwrapped tree, which has no defaults/pref and no
+        # mozilla.cfg, and every pref and script above was silently skipped.
+        buildCommand = old.buildCommand + ''
+          for exe in "$out"/lib/zen*/zen "$out"/lib/zen*/zen-bin; do
+            cp --remove-destination "$(readlink -f "$exe")" "$exe"
+            chmod u+w "$exe"
+          done
+        '';
+      }))
     ];
   };
 }