fix(waybar): supervisor respawn + clean-restart switches; add sys-rebuild

Recovers the crashed iteration #7 (items 21+23, Latitude QA findings):

- nomarchy-waybar supervisor (waybar.nix, exec-once'd from
  hyprland.nix): any waybar exit respawns the bar; crash-loop guard
  (5 fast exits -> critical notify + stop); TERM trapped for a real
  stop. Fixes the bar-less session after a theme-switch crash.
- nomarchy-theme-sync prefers a clean `pkill -x waybar` (supervisor
  restart with fresh config+style) over the crash-prone in-place
  SIGUSR2 reload when the supervisor is running; SIGUSR2 stays as the
  unsupervised fallback.
- sys-rebuild: snapshot-first system rebuild against the CURRENT lock
  (no `nix flake update`) — the no-update twin of sys-update;
  README §3/§5 + motd list it.

Verified: V0 re-run green after crash recovery (flake check --no-build
+ py_compile); V1/V2 per the crashed session's journal entry (HM
renders exec-once=nomarchy-waybar; headless software-GL VM:
SIGKILL -> new pid, clean kill -> respawn, SIGUSR2 -> alive).
V3 pending on the Latitude (queued in HARDWARE-QUEUE.md).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

agent/HARDWARE-QUEUE.md

@@ -73,6 +73,11 @@ QA machine), the **T14s** (webcam case).
 - [ ] **Fingerprint** — `fprintd-enroll` + (opt-in PAM) login/sudo.
 
 ## Latitude 5410 only
+- [ ] **Waybar theme-switch resilience** (finding #1 re-test, needs main ≥
+      the supervisor commit + relogin) — switch themes repeatedly (incl.
+      summer-day/night whole-swaps): the bar restarts cleanly each time;
+      if anything kills it, it's back within ~a second. `pgrep -f
+      nomarchy-waybar` shows the supervisor.
 - [ ] **Media keys + gestures** (from dccceb4) — volume/brightness keys
       drive the OSD; touchpad gestures work.
 - [ ] **v1 QA batch on-hardware pass** (583708d batch was QEMU-verified) —