feat(apps): starter workstation app suite + steam/libvirt/obs services

The "default application suite" roadmap item, but deliberately NOT a
nomarchy.apps.* option surface: a bare package install has no config to
put behind a toggle, so a thin `mkIf x { systemPackages = [p]; }` only
reinvents what a package list already gives. Instead the suite is a
curated home.packages list in templates/downstream/home.nix (extending
the existing `# firefox` convention) — active staples (libreoffice,
vscode, gimp, inkscape, mpv, amberol) plus commented suggestions. The
opt-out is deleting a line; it also keeps the apps out of the live ISO
automatically (the ISO never scaffolds from the template).

The members that DO need system config become nomarchy.services.* opt-in
toggles instead (config behind the switch, like the existing services):
  - steam   → programs.steam (32-bit stack, controller udev, RP ports)
  - libvirt → libvirtd + virt-manager, login user added to libvirtd group
  - obs     → obs-studio + a v4l2loopback virtual camera (exclusive_caps=1)
              selectable as a webcam in Zoom/Teams

README option table, ROADMAP (services item now "Eight shipped"; suite
item marked done with the no-surface rationale) and the downstream
system.nix examples updated to match.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

templates/downstream/system.nix

@@ -36,6 +36,9 @@
   # nomarchy.services.podman.enable = true;    # rootless containers (docker → podman)
   # nomarchy.services.flatpak.enable = true;   # Flatpak + the Flathub remote
   # nomarchy.services.pika.enable = true;      # Pika Backup (GUI Borg backups)
+  # nomarchy.services.steam.enable = true;     # Steam (32-bit libs, controllers, ports)
+  # nomarchy.services.libvirt.enable = true;   # libvirt/KVM + virt-manager GUI
+  # nomarchy.services.obs.enable = true;       # OBS Studio + v4l2loopback virtual camera
 
   system.stateVersion = "26.05";
 }