feat(deps): add marktext and firejail as optional dependencies

Both back the new `md` wrapper and nothing else, so both land in the
Optional tier, skipped by `fish-deps install`/`sync` unless `--optional`
(or `--all`) is passed.

firejail is a plain system package everywhere, so it needs no special
handling. marktext is not: upstream ships an AUR package and its own
GitHub release assets, and no distro carries it under a common name. Its
`_fdc_pm` entry is therefore deliberately empty, and a `marktext-release`
special offers the AUR package via paru/yay where one is present and
otherwise installs upstream's AppImage to ~/.local/bin/marktext.

The release assets embed their version in the filename, so there is no
stable /releases/latest/download URL to fetch -- `_fish_deps_marktext_appimage`
reads the download URL from the GitHub API instead. Upstream builds the
Linux AppImage for x86_64 only, and the helper says so rather than
downloading an unusable binary.

`fish-deps update` refreshes marktext through the AUR where available, and
otherwise only when ~/.local/bin/marktext exists -- a distro-packaged
marktext belongs to that package manager, and dropping an AppImage into
~/.local/bin would shadow it.

docs/fish-config.md

@@ -1050,6 +1050,49 @@ functions). They are active in all interactive sessions.
     Example:
     less /var/log/syslog
 
+### md
+
+    Synopsis:  md [-r] [--foreground] [marktext-args...] [FILE...]
+
+    Opens files in MarkText, detached from the terminal so the shell stays
+    usable and the editor survives closing the window that launched it.
+
+    Every argument is forwarded to marktext untouched except the two flags
+    below, which md consumes itself. marktext's own flags (--new-window,
+    --safe, --disable-gpu, ...) therefore work exactly as documented in
+    marktext --help.
+
+    Flags whose entire purpose is terminal output -- --version, -v/--verbose
+    and --debug -- imply --foreground, since backgrounding them would send
+    the output you asked for to /dev/null.
+
+    --read-only sandboxes the editor with firejail so saving fails instead of
+    overwriting the file. MarkText has no read-only mode of its own.
+
+    Arguments:
+      FILE...            Markdown files to open
+      -r, --read-only    Open sandboxed, with every named file bound read-only
+      --foreground       Run in the foreground; do not detach
+      -h, --help         Show this help message
+
+    Exit Status:
+      0  MarkText launched (or, with --foreground, exited successfully)
+      1  --read-only was requested without firejail or without an existing file
+
+    Notes:
+      This file is autoloaded, so it never shadows an md function or alias
+      defined elsewhere -- fish only looks here when nothing named md exists.
+      A real md *binary* would be shadowed, so md hands off to it verbatim
+      whenever marktext is not installed.
+
+    Example:
+    md README.md
+    md --read-only NOTES.md
+    md --foreground --debug draft.md
+    md --new-window one.md two.md
+
+**Dependencies:** `marktext`, `firejail`, `bkg`
+
 ### rawfish
 
     Synopsis:  rawfish [args...]
@@ -1651,6 +1694,8 @@ functions). They are active in all interactive sessions.
     Example:
     bkg firefox
 
+**Used by:** `md`
+
 ### detach
 
     Synopsis:  detach [-h] [--version] <command> [args...]
@@ -3258,6 +3303,8 @@ matter if you already use that specific tool. Skipped by
 | `docker` | Container runtime; gates the Docker context indicator in the right prompt and backs the `ld` wrapper. Both consumers are guarded with `type -q docker` and degrade gracefully without it. Installing the daemon package does not enable/start the service — do that yourself if you want it running. |
 | `yt-dlp` | Video/media downloader; backs the `yt-dlp` wrapper function. The wrapper falls back to the system `yt-dlp` and the rest of the config works without it. |
 | `screen` | GNU screen; fallback backend for `jobrunner` when `tmux` is unavailable. |
+| `marktext` | Markdown editor; backs the `md` wrapper, which is the only thing that references it. No distro packages it under a common name, so `fish-deps` offers the AUR package (`marktext-bin`) on Arch and otherwise installs upstream's AppImage to `~/.local/bin/marktext`. |
+| `firejail` | Sandbox; needed only by `md --read-only`, which uses it to make MarkText unable to save over the file it opened. Every other `md` invocation works without it. |
 
 ## Terminal Emulators
 

docs/manual/06-dependency-catalog.md

@@ -57,6 +57,8 @@ matter if you already use that specific tool. Skipped by
 | `docker` | Container runtime; gates the Docker context indicator in the right prompt and backs the `ld` wrapper. Both consumers are guarded with `type -q docker` and degrade gracefully without it. Installing the daemon package does not enable/start the service — do that yourself if you want it running. |
 | `yt-dlp` | Video/media downloader; backs the `yt-dlp` wrapper function. The wrapper falls back to the system `yt-dlp` and the rest of the config works without it. |
 | `screen` | GNU screen; fallback backend for `jobrunner` when `tmux` is unavailable. |
+| `marktext` | Markdown editor; backs the `md` wrapper, which is the only thing that references it. No distro packages it under a common name, so `fish-deps` offers the AUR package (`marktext-bin`) on Arch and otherwise installs upstream's AppImage to `~/.local/bin/marktext`. |
+| `firejail` | Sandbox; needed only by `md --read-only`, which uses it to make MarkText unable to save over the file it opened. Every other `md` invocation works without it. |
 
 ## Terminal Emulators