feat: nomarchy.lib.mkFlake — one-call downstream wrapper + hardware profiles

Downstream users now own only system.nix and home.nix; their flake.nix is
generated once from the template and never hand-edited. mkFlake (lib.nix)
wires both layers and maps hardwareProfile = "<name>" to nixos-hardware
modules (new input, pinned here, nixpkgs follows ours; unknown names fail
with did-you-mean suggestions). Flake checks evaluate the template through
mkFlake — including a real profile — so drift fails `nix flake check`.

Also from the live-VM testing session: install the home-manager CLI in the
live ISO and pin flake inputs transitively (offline theme switching needs
stylix's own inputs too), plus swww→awww doc updates.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

templates/downstream/system.nix

@@ -2,7 +2,7 @@
 # The distro itself comes from nomarchy.nixosModules.nomarchy — override
 # any of its defaults here with plain NixOS options (they use mkDefault),
 # or via the nomarchy.system.* toggles.
-{ pkgs, ... }:
+{ pkgs, username, ... }:
 
 {
   boot.loader.systemd-boot.enable = true;
@@ -12,7 +12,8 @@
   time.timeZone = "UTC";
   i18n.defaultLocale = "en_US.UTF-8";
 
-  users.users.me = { # <- keep in sync with `username` in flake.nix
+  # Your login user — `username` flows in from flake.nix automatically.
+  users.users.${username} = {
     isNormalUser = true;
     extraGroups = [ "wheel" "networkmanager" "video" "input" ];
   };