fix(idle): don't lock before an encrypted hibernate (was: unlock after)

The previous nomarchy-hibernate-unlock ran `pkill hyprlock` after a
hibernate resume, but killing a Wayland session-lock client without
releasing the lock trips hyprlock's "go to a tty" crash failsafe -- the
compositor keeps the screen locked for safety. So resume showed a hyprlock
error screen instead of unlocking.

Fix it the right way: never engage the lock before an encrypted hibernate
(the LUKS passphrase at resume is the gate). Replace the post-resume unlock
with a nomarchy-lock-before-sleep unit that takes over hypridle's
before_sleep_cmd: it locks on the RAM-resume sleeps (suspend / hybrid-sleep
/ suspend-then-hibernate) always, and on hibernate.target only when the disk
is unencrypted. idle.nix drops before_sleep_cmd accordingly.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/ROADMAP.md

@@ -131,13 +131,15 @@ how to override it. Items marked ✓ are shipped.
   accent. Reads on light and dark; follows the theme as of the last system
   rebuild (like the background tint).
 - ✓ **Hibernate double-unlock:** on resume from hibernate the LUKS
-  passphrase already gates the machine, but hypridle's `before_sleep_cmd`
-  also locked hyprlock, so the user typed a password twice. Fixed with a
-  `nomarchy-hibernate-unlock` systemd unit (`modules/nixos/default.nix`)
-  that dismisses hyprlock *after* a hibernate resume (`WantedBy
-  hibernate.target`, `After systemd-hibernate.service` → runs post-resume),
-  gated on the disk being LUKS-encrypted. Suspend (and the RAM-resume phase
-  of suspend-then-hibernate) keep locking — they have no passphrase gate.
+  passphrase already gates the machine, but locking hyprlock before sleep
+  meant a second password. Fixed by *not locking* before an encrypted
+  hibernate: a `nomarchy-lock-before-sleep` systemd unit
+  (`modules/nixos/default.nix`) takes over from hypridle's `before_sleep_cmd`
+  and locks on the RAM-resume sleeps (suspend / hybrid-sleep / suspend-then-
+  hibernate) always, but skips `hibernate.target` when the disk is LUKS-
+  encrypted. (A first attempt that dismissed hyprlock *after* resume was
+  wrong — killing a Wayland session-lock client trips its "go to a tty"
+  crash failsafe instead of unlocking, which is the error screen it caused.)
 - ✓ **Key agents & pinentry:** ships `modules/home/keys.nix`
   (`nomarchy.keys.enable`): one agent — `services.gpg-agent` with
   `enableSshSupport` fronts SSH, so a single `pinentry-qt` (native-Wayland,