feat: nomarchy.lib.mkFlake — one-call downstream wrapper + hardware profiles

Downstream users now own only system.nix and home.nix; their flake.nix is
generated once from the template and never hand-edited. mkFlake (lib.nix)
wires both layers and maps hardwareProfile = "<name>" to nixos-hardware
modules (new input, pinned here, nixpkgs follows ours; unknown names fail
with did-you-mean suggestions). Flake checks evaluate the template through
mkFlake — including a real profile — so drift fails `nix flake check`.

Also from the live-VM testing session: install the home-manager CLI in the
live ISO and pin flake inputs transitively (offline theme switching needs
stylix's own inputs too), plus swww→awww doc updates.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

templates/downstream/README.md

@@ -1,8 +1,13 @@
 # My Nomarchy machine
 
-1. `nixos-generate-config --show-hardware-config > hardware-configuration.nix`
-2. Edit `flake.nix` (Nomarchy repo URL, username), `system.nix` (hostname,
-   user), `home.nix` (your packages).
+1. Overwrite the placeholder hardware config with the real one:
+   `nixos-generate-config --show-hardware-config > hardware-configuration.nix`
+2. Set `flake.nix` up **once** (Nomarchy repo URL, your username, optionally
+   a `hardwareProfile` from <https://github.com/NixOS/nixos-hardware> — an
+   unknown name fails the rebuild with suggestions). After that the flake is
+   never touched again: your machine lives in `system.nix` (hostname,
+   services — the login user is created from `username` automatically) and
+   `home.nix` (your packages).
 3. `git init && git add -A` — flakes only see tracked files, including
    `theme-state.json`.
 4. System: `sudo nixos-rebuild switch --flake .#default`