feat(cli): nomarchy-pull / nomarchy-rebuild / nomarchy-home

Split lifecycle into three clear commands (user pick):
  nomarchy-pull     git pull (if checkout) + flake.lock update
  nomarchy-rebuild  system switch on current lock (snap + nvd)
  nomarchy-home     Home Manager switch

Full upgrade: pull && rebuild && home. Legacy sys-update / sys-rebuild /
home-update remain as wrappers. nixos-rebuild-snap uses NOMARCHY_PATH.

V0: flake check --no-build green.

agent/MEMORY.md

@@ -124,8 +124,9 @@ iteration would otherwise rediscover.
 - GTK4/libadwaita/Qt6 read light/dark from the portal's
   `org.freedesktop.appearance color-scheme` (dconf), not Stylix polarity
   (§ GTK/Qt ignore the theme's mode).
-- Update order matters downstream: `sys-update` (lock) before
-  `home-update`, or desktop changes are silently skipped against the old
+- Update order matters downstream: `nomarchy-pull` (lock) then
+  `nomarchy-rebuild` then `nomarchy-home`, or desktop changes are silently
+  skipped against the old
   lock (README § 3).
 - Hyprland 0.53 rewrote window rules: `windowrulev2` is a hard error and
   the old rule-first `float, class:^…$` no longer parses — both surface a