feat: nomarchy.lib.mkFlake — one-call downstream wrapper + hardware profiles

Downstream users now own only system.nix and home.nix; their flake.nix is
generated once from the template and never hand-edited. mkFlake (lib.nix)
wires both layers and maps hardwareProfile = "<name>" to nixos-hardware
modules (new input, pinned here, nixpkgs follows ours; unknown names fail
with did-you-mean suggestions). Flake checks evaluate the template through
mkFlake — including a real profile — so drift fails `nix flake check`.

Also from the live-VM testing session: install the home-manager CLI in the
live ISO and pin flake inputs transitively (offline theme switching needs
stylix's own inputs too), plus swww→awww doc updates.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/TESTING.md

@@ -18,7 +18,9 @@ python3 -m py_compile pkgs/nomarchy-theme-sync/nomarchy-theme-sync.py
 
 `nix flake check` needs a Linux machine (or a Linux builder) since all
 outputs are `x86_64-linux`. It catches type errors, missing options, and
-bad merges — most breakage stops here.
+bad merges — most breakage stops here. It also evaluates the downstream
+template through `lib.mkFlake` (including a real nixos-hardware profile),
+so template/wrapper drift fails fast too.
 
 ## 2. Build and boot the live ISO
 
@@ -51,7 +53,7 @@ Work through these in order; each one exercises a different layer.
 
 | # | Check | Verifies |
 |---|---|---|
-| 1 | Boots to Hyprland with Tokyo Night wallpaper visible | greetd autologin, swww, session start |
+| 1 | Boots to Hyprland with Tokyo Night wallpaper visible | greetd autologin, awww, session start |
 | 2 | Waybar shows at top, themed (blue accent on dark) | HM waybar module, palette baking |
 | 3 | `SUPER+Return` opens Ghostty with Tokyo Night colors | terminal default, ANSI palette |
 | 4 | `btop` in the terminal is themed | per-theme asset baking |