feat: nomarchy.lib.mkFlake — one-call downstream wrapper + hardware profiles

Downstream users now own only system.nix and home.nix; their flake.nix is
generated once from the template and never hand-edited. mkFlake (lib.nix)
wires both layers and maps hardwareProfile = "<name>" to nixos-hardware
modules (new input, pinned here, nixpkgs follows ours; unknown names fail
with did-you-mean suggestions). Flake checks evaluate the template through
mkFlake — including a real profile — so drift fails `nix flake check`.

Also from the live-VM testing session: install the home-manager CLI in the
live ISO and pin flake inputs transitively (offline theme switching needs
stylix's own inputs too), plus swww→awww doc updates.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

flake.nix

@@ -14,9 +14,17 @@
       inputs.nixpkgs.follows = "nixpkgs";
       inputs.home-manager.follows = "home-manager";
     };
+
+    # Pinned by Nomarchy so distro + hardware quirks are tested together
+    # (consumed by lib.mkFlake's hardwareProfile). Its nixpkgs input is
+    # only used by its own CI — follow ours to keep locks/ISO lean.
+    nixos-hardware = {
+      url = "github:NixOS/nixos-hardware/master";
+      inputs.nixpkgs.follows = "nixpkgs";
+    };
   };
 
-  outputs = { self, nixpkgs, home-manager, stylix, ... }:
+  outputs = { self, nixpkgs, home-manager, stylix, nixos-hardware, ... }:
     let
       system = "x86_64-linux";
       username = "nomarchy"; # reference host only; downstream picks its own
@@ -52,6 +60,14 @@
         imports = [ stylix.homeModules.stylix ./modules/home ];
       };
 
+      # One-call downstream wrapper — see templates/downstream/flake.nix.
+      # The generated flake is never hand-edited; machines live in
+      # system.nix / home.nix.
+      lib = import ./lib.nix {
+        inherit nixpkgs home-manager nixos-hardware;
+        nomarchy = self;
+      };
+
       templates.default = {
         path = ./templates/downstream;
         description = "Nomarchy machine configuration (downstream flake)";
@@ -62,7 +78,31 @@
         default = pkgs.nomarchy-theme-sync;
       };
 
+      # ─── Checks ────────────────────────────────────────────────────
+      # `nix flake check` never evaluates templates/, so exercise the
+      # downstream template through mkFlake directly (this bypasses the
+      # template's own three-line flake.nix, which only resolves once
+      # instantiated — everything else is covered here, including the
+      # hardwareProfile → nixos-hardware mapping).
+      checks.${system} =
+        let
+          downstream = self.lib.mkFlake {
+            src = ./templates/downstream;
+            username = "me";
+            hardwareProfile = "framework-13-7040-amd"; # exercises the mapping
+          };
+        in
+        {
+          downstream-template-system =
+            downstream.nixosConfigurations.default.config.system.build.toplevel;
+          downstream-template-home =
+            downstream.homeConfigurations.me.activationPackage;
+        };
+
       # ─── Reference host ────────────────────────────────────────────
+      # Manually wired rather than via lib.mkFlake: the repo-root
+      # theme-state.json is load-bearing (live ISO + in-repo CLI dev),
+      # which doesn't match mkFlake's src-layout convention.
       # Deliberately split rebuild paths:
       #   system  → sudo nixos-rebuild switch --flake .#nomarchy   (rare)
       #   desktop → home-manager switch --flake .#nomarchy         (no sudo;
@@ -122,15 +162,24 @@
               };
             };
 
+            # The standalone CLI that `nomarchy-theme-sync apply` runs for
+            # theme switching, from the same pinned input.
+            environment.systemPackages = [
+              home-manager.packages.${system}.home-manager
+            ];
+
             # Keep the locked flake inputs in the ISO store so theme
             # switching on the live system works without a network: the
             # lockfile's narHashes resolve against these paths instead
-            # of fetching from GitHub.
-            system.extraDependencies = [
-              nixpkgs.outPath
-              home-manager.outPath
-              stylix.outPath
-            ];
+            # of fetching from GitHub. Must be *transitive* — evaluating
+            # the seeded flake also fetches stylix's own inputs.
+            system.extraDependencies =
+              let
+                collectInputs = input:
+                  [ input.outPath ] ++ builtins.concatMap collectInputs
+                    (builtins.attrValues (input.inputs or { }));
+              in
+              collectInputs self;
           }
         ];
       };