fix(waybar): supervisor respawn + clean-restart switches; add sys-rebuild

Recovers the crashed iteration #7 (items 21+23, Latitude QA findings):

- nomarchy-waybar supervisor (waybar.nix, exec-once'd from
  hyprland.nix): any waybar exit respawns the bar; crash-loop guard
  (5 fast exits -> critical notify + stop); TERM trapped for a real
  stop. Fixes the bar-less session after a theme-switch crash.
- nomarchy-theme-sync prefers a clean `pkill -x waybar` (supervisor
  restart with fresh config+style) over the crash-prone in-place
  SIGUSR2 reload when the supervisor is running; SIGUSR2 stays as the
  unsupervised fallback.
- sys-rebuild: snapshot-first system rebuild against the CURRENT lock
  (no `nix flake update`) — the no-update twin of sys-update;
  README §3/§5 + motd list it.

Verified: V0 re-run green after crash recovery (flake check --no-build
+ py_compile); V1/V2 per the crashed session's journal entry (HM
renders exec-once=nomarchy-waybar; headless software-GL VM:
SIGKILL -> new pid, clean kill -> respawn, SIGUSR2 -> alive).
V3 pending on the Latitude (queued in HARDWARE-QUEUE.md).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

modules/nixos/default.nix

@@ -53,6 +53,7 @@ in
         ${distroName} — a NixOS desktop, themed from one JSON.
 
         sys-update                          update inputs + rebuild the system
+        sys-rebuild                         rebuild the system, no input update
         home-update                         apply home/theme changes (no sudo)
         nomarchy-theme-sync apply <theme>   switch the whole palette
         SUPER+?                             keybindings cheatsheet
@@ -312,6 +313,23 @@ in
           sudo nixos-rebuild switch --flake "$flake#default" "$@"
         fi
       '')
+      # The no-update twin (hardware-QA request): rebuild the system
+      # against the CURRENT lock — config changes only, no `nix flake
+      # update` — mirroring how home-update never touches the lock.
+      # Same snapshot-first path when available.
+      (pkgs.writeShellScriptBin "sys-rebuild" ''
+        set -e
+        if [ "$(id -u)" -eq 0 ]; then
+          echo "sys-rebuild: run as your normal user (it sudos the rebuild itself)" >&2
+          exit 1
+        fi
+        flake="''${NOMARCHY_PATH:-$HOME/.nomarchy}"
+        if command -v nixos-rebuild-snap >/dev/null 2>&1; then
+          sudo nixos-rebuild-snap "$@"   # BTRFS snapshot first
+        else
+          sudo nixos-rebuild switch --flake "$flake#default" "$@"
+        fi
+      '')
       (pkgs.writeShellScriptBin "home-update" ''
         set -e
         exec home-manager switch --flake "''${NOMARCHY_PATH:-$HOME/.nomarchy}" "$@"