Font install check: anchor to exact family 'Maple Mono NF'

The previous substring check (*"Maple Mono NF"* glob / grep -q substring)
matched 'Maple Mono NF CN' too, which silently skipped the Latin-only NF
install on boxes that had only the CJK variant installed (byte, kaiser —
they shipped with maple-font system package that defaults to NF CN).

Result: foot (and any other config asking for 'Maple Mono NF') silently
fell back to system sans on byte and kaiser, while looking like a
working terminal. Compounded by foot.ini asking for 'Maple Mono CN'
(see prior commit c6779c5), which masked the missing NF install on
miche (which has both CN and NF).

Fix: use fc-list : family | grep -qxF 'Maple Mono NF' which:
- prints one family per line (no style suffixes to confuse grep)
- -x anchors whole line
- -F fixed string (no regex)
- matches exactly 'Maple Mono NF' and nothing else

Why not fc-match? fc-match reports a substitute when the family isn't
installed (Noto/Liberation/DejaVu depending on distro), so it can't
distinguish 'NF installed' from 'NF not installed, fell back'.

Verified on byte: fc-list : family | grep -qxF 'Maple Mono NF' returns
1 (false) because byte has only 'Maple Mono NF CN', so the install will
now run on next chezmoi apply.

run_once_20-install-user-packages-gentoo.sh.tmpl

@@ -263,7 +263,9 @@ else
 fi
 
 # Step 9: Maple Mono NF font
-if ! fc-list | grep -qi "Maple Mono NF"; then
+# Match EXACT family "Maple Mono NF", not "Maple Mono NF CN" or other variants.
+# See run_once_20-install-user-packages.sh.tmpl for the rationale.
+if ! fc-list : family 2>/dev/null | grep -qxF 'Maple Mono NF'; then
     log "installing Maple Mono NF font"
     # Download the latest release zip
     TMPFONT=$(mktemp -d)