feat(menu): System › Rollback — desktop generations picker (item 9b, item 9 done)

Undo is one menu away: the new rollback flow lists the last ten Home
Manager generations (the theme/config history is already generations,
newest marked current) and activates the picked one in a terminal —
HM's supported rollback, reversible by re-picking a newer one, so no
typed-yes gate. System-level undo deliberately links out rather than
reimplementing destructive flows in rofi: the Snapshots row opens the
existing gated flow, and 'boot an older generation (how)' fires an
instruction notification pointing at docs/RECOVERY.md §3 (which now
cross-references the menu path).

V1: template-home built, generated menu bash -n clean, row rendering
and pick-parsing verified against fixture generations output. V3
exercise queued.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

agent/BACKLOG.md

@@ -26,18 +26,6 @@ next, in what order*.
 
 ## NEXT
 
-### 9. Update & rollback UX
-New; extends the update-awareness story to the other half: what changed,
-and how do I get back. Done: (a) `sys-update` AND `sys-rebuild` end with
-an `nvd diff` of old→new generation (store-path-pinned; never fails the
-run; "no changes" fast-path). Remaining: (b) a **System → Rollback**
-menu flow: desktop = pick a recent `home-manager generations` entry and
-activate it (the theme history is already generations); system = point
-at the boot-menu generation flow + `nomarchy-snapshots` rather than
-reimplementing it — destructive steps keep the typed-`yes` gate.
-**Why:** informative + rock-stable means undo is one menu away, not a
-Nix lesson. **Verify:** V1; V2 for the generation-activate path in a VM.
-
 ### 10. `nomarchy-doctor` — one-shot health check
 New. A single command (+ System-menu entry) that checks the things that
 actually break user machines and prints a themed pass/fail sheet: