feat: nomarchy.lib.mkFlake — one-call downstream wrapper + hardware profiles

Downstream users now own only system.nix and home.nix; their flake.nix is
generated once from the template and never hand-edited. mkFlake (lib.nix)
wires both layers and maps hardwareProfile = "<name>" to nixos-hardware
modules (new input, pinned here, nixpkgs follows ours; unknown names fail
with did-you-mean suggestions). Flake checks evaluate the template through
mkFlake — including a real profile — so drift fails `nix flake check`.

Also from the live-VM testing session: install the home-manager CLI in the
live ISO and pin flake inputs transitively (offline theme switching needs
stylix's own inputs too), plus swww→awww doc updates.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

lib.nix

@@ -0,0 +1,80 @@
+# Downstream sugar: one call wires a whole machine flake.
+# Users own ONLY system.nix, home.nix and theme-state.json; their flake.nix
+# is generated once (by `nix flake init -t` or the future installer) and
+# never hand-edited. The raw exports (nixosModules/homeModules/overlays)
+# in flake.nix remain the escape hatch for power users.
+{ nixpkgs, home-manager, nixos-hardware, nomarchy }:
+
+{
+  mkFlake =
+    { src                      # the downstream flake directory (./.)
+    , username                 # login name; also the homeConfigurations attr
+    , hardwareProfile ? null   # a nixos-hardware module name, or null
+    , system ? "x86_64-linux"
+    }:
+    let
+      inherit (nixpkgs) lib;
+
+      hardwareModules =
+        if hardwareProfile == null then
+          [ ]
+        else if builtins.hasAttr hardwareProfile nixos-hardware.nixosModules then
+          [ nixos-hardware.nixosModules.${hardwareProfile} ]
+        else
+          throw ''
+            nomarchy.lib.mkFlake: unknown hardwareProfile "${hardwareProfile}".
+            ${let
+                close = builtins.filter
+                  (name: lib.strings.levenshteinAtMost 3 name hardwareProfile)
+                  (builtins.attrNames nixos-hardware.nixosModules);
+              in
+              lib.optionalString (close != [ ])
+                "Did you mean: ${lib.concatStringsSep ", " close}?\n"
+            }Valid names are the attribute names of nixos-hardware.nixosModules:
+              https://github.com/NixOS/nixos-hardware
+            or list them locally with:
+              nix eval github:NixOS/nixos-hardware#nixosModules --apply builtins.attrNames
+            Omit hardwareProfile entirely if your machine has no profile.
+          '';
+
+      pkgs = import nixpkgs {
+        inherit system;
+        overlays = [ nomarchy.overlays.default ];
+      };
+    in
+    {
+      # System layer — rebuilt rarely:
+      #   sudo nixos-rebuild switch --flake .#default
+      nixosConfigurations.default = nixpkgs.lib.nixosSystem {
+        inherit system;
+        specialArgs = { inherit username; };
+        modules =
+          [ nomarchy.nixosModules.nomarchy ]
+          ++ hardwareModules
+          ++ [
+            (src + "/hardware-configuration.nix") # from nixos-generate-config
+            (src + "/system.nix")
+          ];
+      };
+
+      # Desktop layer — every theme change, no sudo:
+      #   home-manager switch --flake .#<username>
+      # (`nomarchy-theme-sync apply` runs this for you.)
+      homeConfigurations.${username} = home-manager.lib.homeManagerConfiguration {
+        inherit pkgs;
+        modules = [
+          nomarchy.homeModules.nomarchy
+          (src + "/home.nix")
+          {
+            # Written by nomarchy-theme-sync; reading it is pure — the
+            # file is part of the downstream flake's source.
+            nomarchy.stateFile = src + "/theme-state.json";
+            home = {
+              inherit username;
+              homeDirectory = "/home/${username}";
+            };
+          }
+        ];
+      };
+    };
+}