feat(welcome): show "What's installed?" summary on first boot

New nomarchy-installed-summary script renders a markdown table via
gum format with the install shape the user should verify before they
start customising:

  - theme / font / panel position    (~/.config/nomarchy/state.json)
  - timezone / DNS / hybrid GPU      (/etc/nixos/state.json)
  - form factor                      (BAT* sysfs presence)
  - software profiles                (presence of marker packages)
  - FDE                              (any crypt entry in lsblk)
  - drives                           (lsblk filtered to disk/part/crypt)

nomarchy-welcome calls it as Step 0 — before the theme/font/panel
pickers — and gates progression on a gum input prompt so the user has
to acknowledge before customisation rewrites anything. The script is
also callable standalone from any terminal: `nomarchy-installed-summary`.

Self-contained — no installer-side changes. Software profiles are
detected heuristically (the installer bakes the user's pick into the
generated home.nix as concrete home.packages rather than persisting a
profile list), which is good enough for verification but won't catch
manually-removed profile packages. gum is in the existing categoryDeps
so no new tools are needed; falls back to plain markdown when gum
isn't on PATH (recovery contexts).

Closes the "Installer: What's installed? summary on first boot"
Now-column item from Pillar 4.

features/scripts/utils/nomarchy-installed-summary

@@ -0,0 +1,99 @@
+#!/usr/bin/env bash
+set -e
+
+# Print a curated "what the installer wrote" summary so the user can verify
+# the system shape on first boot before they start customising. Reads from
+# state.json where the schema persists the value, and falls back to live
+# introspection for things the schema doesn't track (form factor, drives,
+# active software profiles, FDE).
+#
+# Invoked as Step 0 of nomarchy-welcome and available as a standalone CLI.
+
+HOME_STATE="$HOME/.config/nomarchy/state.json"
+SYS_STATE="/etc/nixos/state.json"
+
+jq_or_empty() {
+    local file="$1"
+    local query="$2"
+    [[ -f "$file" ]] || { echo ""; return; }
+    jq -r "$query // empty" "$file" 2>/dev/null || echo ""
+}
+
+theme=$(jq_or_empty "$HOME_STATE" '.theme')
+font=$(jq_or_empty "$HOME_STATE" '.font')
+panel=$(jq_or_empty "$HOME_STATE" '.panelPosition')
+tz=$(jq_or_empty "$SYS_STATE" '.timezone')
+dns=$(jq_or_empty "$SYS_STATE" '.dns')
+hybrid_gpu=$(jq_or_empty "$SYS_STATE" '.features.hybridGPU')
+
+# Form factor: same battery-presence check the installer uses to auto-set
+# nomarchy.{system.,}formFactor.
+if compgen -G "/sys/class/power_supply/BAT*" >/dev/null; then
+    form_factor="laptop"
+else
+    form_factor="desktop"
+fi
+
+# Active software profiles: heuristic detection. The installer bakes the
+# user's pick into the generated home.nix as concrete `home.packages` /
+# system toggles rather than persisting a profile list, so we check for
+# the marker package of each profile.
+profiles=()
+command -v docker >/dev/null 2>&1 && profiles+=("Dev")
+command -v steam  >/dev/null 2>&1 && profiles+=("Gaming")
+command -v libreoffice >/dev/null 2>&1 && profiles+=("Office")
+command -v obs >/dev/null 2>&1 && profiles+=("Media")
+command -v rg >/dev/null 2>&1 && profiles+=("CLI Utils")
+
+profiles_str="None"
+if (( ${#profiles[@]} > 0 )); then
+    profiles_str="$(IFS=', '; echo "${profiles[*]}")"
+fi
+
+# FDE: any crypt device present means the install used LUKS.
+luks="No"
+if lsblk -no TYPE 2>/dev/null | grep -q '^crypt$'; then
+    luks="Yes"
+fi
+
+# Drives: target disks + their mounted root/boot/crypt partitions. Filter
+# noise (loop/rom/zram) so the table reads like an install receipt.
+drives=$(lsblk -no NAME,SIZE,TYPE,MOUNTPOINT 2>/dev/null \
+    | grep -Ev '^(loop|sr|zram)' \
+    | awk 'NF>=3 && $3 ~ /^(disk|part|crypt)$/' \
+    || true)
+
+version_line=$(nomarchy-version 2>/dev/null || echo "Nomarchy")
+hostname_line="$(hostname 2>/dev/null || echo "")"
+
+# Render via gum format (markdown). Fallback to plain text when gum isn't
+# on PATH — keeps the script callable from minimal contexts like recovery.
+render() {
+    cat <<MD
+# $version_line on \`$hostname_line\`
+
+| Setting       | Value             |
+| ---           | ---               |
+| Theme         | ${theme:-—}       |
+| Font          | ${font:-—}        |
+| Panel         | ${panel:-—}       |
+| Form factor   | $form_factor      |
+| Timezone      | ${tz:-—}          |
+| DNS           | ${dns:-—}         |
+| Hybrid GPU    | ${hybrid_gpu:-false} |
+| Profiles      | $profiles_str     |
+| FDE (LUKS)    | $luks             |
+
+## Drives
+
+\`\`\`
+$drives
+\`\`\`
+MD
+}
+
+if command -v gum >/dev/null 2>&1; then
+    render | gum format
+else
+    render
+fi