feat(flake): #134 — unstable.<pkg> in the downstream, one input, no hand pins

Nomarchy now carries a nixpkgs-unstable input and exposes it through
overlays.default as an `unstable` attrset: in the template's
`home.packages = with pkgs; [ … ]` a user writes `unstable.lmstudio`
and is done. Downstream stays one locked input; nomarchy-pull moves it.
lib.nix needed zero changes — mkFlake's pkgs already applies the
overlay. The import is plain and non-recursive, so configs that never
reference unstable. pay nothing beyond the input fetch; allowUnfree
mirrors the base set so the motivating lmstudio resolves.

Home packages are the supported surface (documented convention). Costs
stated in the README, not hidden: you own the pinned+unstable
combination; a second toolchain lands in your closure (~690 of ~4k
paths shared, measured on lmstudio); it moves when the lock moves.
Lock bumps now move two channels — VERIFICATION §5 and CONVENTIONS
updated accordingly. flake.lock gained exactly one node
(nixos-unstable @ 753cc8a); nothing else moved.

Verification: V1 — nix flake check --no-build green; new eval-only
checks.unstable-seam green (26.05pre vs 26.11pre lib.version, no
builds); template HM activation built via mkFlake with unstable.hello
enabled and its closure carries the unstable store path (pg2zfr… vs
pinned nm7p8w…). Implementation by a Sonnet subagent; design and
review on Fable.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

agent/VERIFICATION.md

@@ -137,7 +137,10 @@ Maintenance follows the same ladder:
 - **Flake lock bumps**: treat as maximum-blast-radius changes. Build,
   boot the VM, run the full regression checklist, and do a visual
   spot-check of the session (themes can shift with upstream package
-  changes). Never merge a lock bump on "it evaluates".
+  changes). Never merge a lock bump on "it evaluates". Since #134 the
+  lock carries **two channels** (the release pin and the
+  `nixos-unstable` pin feeding `unstable.*`) — a bump moves both, and
+  this checklist applies to both.
 - **Theme imports / new themes**: import via `tools/import-palettes.py`,
   then the full §3 visual protocol; additionally verify the theme-switch
   round trip (into the new theme and back out).