feat(cli): nomarchy-pull / nomarchy-rebuild / nomarchy-home

Split lifecycle into three clear commands (user pick):
  nomarchy-pull     git pull (if checkout) + flake.lock update
  nomarchy-rebuild  system switch on current lock (snap + nvd)
  nomarchy-home     Home Manager switch

Full upgrade: pull && rebuild && home. Legacy sys-update / sys-rebuild /
home-update remain as wrappers. nixos-rebuild-snap uses NOMARCHY_PATH.

V0: flake check --no-build green.

README.md

@@ -182,22 +182,29 @@ home-manager switch --flake .#me              # desktop: every theme change, no
 Day-to-day you'll use the shipped shortcuts instead:
 
 ```sh
-sys-update    # nix flake update + system rebuild (BTRFS snapshot first when available)
-sys-rebuild   # system rebuild against the CURRENT lock (config changes only, no update)
-              # …both end with a package-level diff of what the rebuild changed (nvd)
-home-update   # home-manager switch (no flake update, no sudo)
+nomarchy-pull      # git pull (if checkout) + nix flake update  — no rebuild
+nomarchy-rebuild   # system rebuild against the CURRENT lock (sudo inside;
+                   # BTRFS snapshot first when snapper is on; nvd diff after)
+nomarchy-home      # home-manager switch — desktop only, no sudo, no lock bump
 ```
 
-**Order matters when pulling distro updates.** `home-update` does *not*
-touch the lock — it rebuilds the desktop against the **current**
-`flake.lock`. A new Nomarchy revision (new keybinds, theming, modules)
-arrives only when the lock is updated, which `sys-update` does
-(`nix flake update`). So to pull an update that affects the desktop layer:
-run `sys-update` **first** (updates the lock + rebuilds the system), **then**
-`home-update` (re-applies the desktop against the new lock). Doing them in
-the other order rebuilds the desktop against the *old* inputs and silently
-skips the new home-side changes. After a home-side keybind/config change,
-also `hyprctl reload` (or relogin) so the running session re-reads it.
+| When | Run |
+|---|---|
+| Pull newer Nomarchy / nixpkgs / inputs | `nomarchy-pull` |
+| You changed `system.nix` (or after pull) | `nomarchy-rebuild` |
+| You changed `home.nix` / theme / desktop | `nomarchy-home` |
+| Full upgrade (inputs + both layers) | `nomarchy-pull && nomarchy-rebuild && nomarchy-home` |
+
+**Order matters for distro updates.** `nomarchy-home` rebuilds against the
+**current** `flake.lock` — it never updates inputs. A new Nomarchy revision
+lands only when the lock is updated (`nomarchy-pull`). So for an upstream
+desktop change: **pull → rebuild → home**. Home before pull rebuilds against
+the old inputs and silently skips new home-side changes. After a home-side
+keybind/config change, also `hyprctl reload` (or relogin) so the session
+re-reads it.
+
+Legacy aliases still work: `sys-update` → pull+rebuild, `sys-rebuild` →
+`nomarchy-rebuild`, `home-update` → `nomarchy-home`.
 
 Override anything via the `nomarchy.*` surface or plain NixOS/HM options:
 appearance (gaps/colors/fonts) changes through `nomarchy-theme-sync`,
@@ -397,9 +404,9 @@ nomarchy-theme-sync set ui.gapsOut 16  # tweak one knob (also a switch)
 nomarchy-theme-sync bg next            # cycle wallpapers — instant, no rebuild
 nomarchy-theme-sync bg auto            # back to the theme's default wallpaper
 nomarchy-theme-sync get colors.accent
-sys-update                             # update inputs + rebuild the system (snapshots first)
-sys-rebuild                            # rebuild the system, current lock (no update)
-home-update                            # rebuild just the desktop layer
+nomarchy-pull                          # git pull + flake input update (no rebuild)
+nomarchy-rebuild                       # rebuild the system, current lock
+nomarchy-home                          # rebuild just the desktop layer
 nomarchy-doctor                        # read-only health sheet (also: menu › System › Doctor)
 ```
 
@@ -429,9 +436,9 @@ gd   gds                        # diff · diff --staged
 gl   glg                        # log graph (last 20 · all branches)
 gp   gpl   gf                   # push · pull · fetch --all --prune
 
-# nix  (system/home rebuilds keep their full sys-update / home-update names)
+# nix  (lifecycle: nomarchy-pull / nomarchy-rebuild / nomarchy-home — full names)
 ns   nr                         # nix shell · nix run   (e.g. ns nixpkgs#ripgrep)
-nfu  nfc                        # nix flake update · check
+nfu  nfc                        # nix flake update · check  (prefer nomarchy-pull for day-to-day)
 nsearch    ngc                  # nix search nixpkgs · nix-collect-garbage -d
 
 # misc