feat(flake): #134 — unstable.<pkg> in the downstream, one input, no hand pins

Nomarchy now carries a nixpkgs-unstable input and exposes it through
overlays.default as an `unstable` attrset: in the template's
`home.packages = with pkgs; [ … ]` a user writes `unstable.lmstudio`
and is done. Downstream stays one locked input; nomarchy-pull moves it.
lib.nix needed zero changes — mkFlake's pkgs already applies the
overlay. The import is plain and non-recursive, so configs that never
reference unstable. pay nothing beyond the input fetch; allowUnfree
mirrors the base set so the motivating lmstudio resolves.

Home packages are the supported surface (documented convention). Costs
stated in the README, not hidden: you own the pinned+unstable
combination; a second toolchain lands in your closure (~690 of ~4k
paths shared, measured on lmstudio); it moves when the lock moves.
Lock bumps now move two channels — VERIFICATION §5 and CONVENTIONS
updated accordingly. flake.lock gained exactly one node
(nixos-unstable @ 753cc8a); nothing else moved.

Verification: V1 — nix flake check --no-build green; new eval-only
checks.unstable-seam green (26.05pre vs 26.11pre lib.version, no
builds); template HM activation built via mkFlake with unstable.hello
enabled and its closure carries the unstable store path (pg2zfr… vs
pinned nm7p8w…). Implementation by a Sonnet subagent; design and
review on Fable.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

agent/CONVENTIONS.md

@@ -68,5 +68,7 @@ those, it probably shouldn't exist.
 - Commit style: `feat|fix|test|docs|chore(scope): summary`, body with
   what/why + verification tier + what remains. Bookkeeping (`agent/`
   updates) rides in the same commit as the change.
-- `flake.lock` moves only when the task *is* a lock bump, and only within
-  the pinned release branches.
+- `flake.lock` moves only when the task *is* a lock bump. The release
+  inputs stay within their pinned release branches; the `nixpkgs-unstable`
+  input (#134, feeds `unstable.*`) tracks `nixos-unstable` and bumps
+  together with the rest — never alone, never `nix flake update`.