fix(waybar): supervisor respawn + clean-restart switches; add sys-rebuild

Recovers the crashed iteration #7 (items 21+23, Latitude QA findings):

- nomarchy-waybar supervisor (waybar.nix, exec-once'd from
  hyprland.nix): any waybar exit respawns the bar; crash-loop guard
  (5 fast exits -> critical notify + stop); TERM trapped for a real
  stop. Fixes the bar-less session after a theme-switch crash.
- nomarchy-theme-sync prefers a clean `pkill -x waybar` (supervisor
  restart with fresh config+style) over the crash-prone in-place
  SIGUSR2 reload when the supervisor is running; SIGUSR2 stays as the
  unsupervised fallback.
- sys-rebuild: snapshot-first system rebuild against the CURRENT lock
  (no `nix flake update`) — the no-update twin of sys-update;
  README §3/§5 + motd list it.

Verified: V0 re-run green after crash recovery (flake check --no-build
+ py_compile); V1/V2 per the crashed session's journal entry (HM
renders exec-once=nomarchy-waybar; headless software-GL VM:
SIGKILL -> new pid, clean kill -> respawn, SIGUSR2 -> alive).
V3 pending on the Latitude (queued in HARDWARE-QUEUE.md).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

agent/BACKLOG.md

@@ -25,23 +25,6 @@ next, in what order*.
 *Items 21–24: real-hardware QA findings from the Latitude 5410
 (Bernardo, 2026-07-04) — bugs found on metal outrank the queue.*
 
-### 21. Waybar crash on theme switch — no respawn
-Reported: after a theme switch on the Latitude, Waybar crashed and
-never came back (exec-once = no supervisor; a crash orphans the session
-until relogin). Two halves: (a) **resilience** — Waybar must respawn on
-crash regardless of cause. exec-once a small supervisor loop (restart
-with backoff; must not fight `pkill -x waybar` intentional stops), or
-re-attempt the systemd user unit with an IPC-readiness gate (the naive
-unit raced Hyprland IPC on relogin — see waybar.nix's comment). (b)
-**root cause** — the switch path both flips `style.css` (Waybar's
-`reload_style_on_change` picks it up) *and* sends SIGUSR2
-(`nomarchy-theme-sync`), a double-reload during the config/css symlink
-flip; suspect the race crashes Waybar's reload. Consider: drop the
-SIGUSR2 when `reload_style_on_change` is on, or replace reload with a
-clean restart on switch. **Verify:** V2 (kill waybar in the themed-VM
-recipe → respawns; switch theme → bar survives); V3 re-check on the
-Latitude.
-
 ### 22. Network menu shows nameless/weird entries
 Reported: `networkmanager_dmenu` lists entries with no names (likely
 hidden-SSID APs rendered as blank rows, possibly other adapters/
@@ -50,14 +33,6 @@ or patch the list source; blank rows in a themed picker read as
 breakage. **Verify:** V1 (config renders) — behavior needs Wi-Fi
 hardware → V3 on the Latitude.
 
-### 23. `sys-rebuild` — rebuild without updating the lock
-Reported: there's no way to rebuild the system *without* `sys-update`'s
-`nix flake update` (home-update already skips the lock; the system side
-lacks the twin). Add `sys-rebuild` (snapshot-first like sys-update,
-rebuild against the current lock, no update) alongside `sys-update`;
-document both in README §5 + the motd cheat sheet if it lists them.
-**Verify:** V1 + eval that both scripts land on PATH.
-
 ### 24. "Back" audit — every list menu ends in ↩ Back
 Reported: some submenu items/tools still lack a Back option. The "Back
 everywhere" pass covered the hand-rolled dmenu lists at the time; audit