feat(cli): nomarchy-pull / nomarchy-rebuild / nomarchy-home

Split lifecycle into three clear commands (user pick):
  nomarchy-pull     git pull (if checkout) + flake.lock update
  nomarchy-rebuild  system switch on current lock (snap + nvd)
  nomarchy-home     Home Manager switch

Full upgrade: pull && rebuild && home. Legacy sys-update / sys-rebuild /
home-update remain as wrappers. nixos-rebuild-snap uses NOMARCHY_PATH.

V0: flake check --no-build green.

docs/ROADMAP.md

@@ -264,9 +264,9 @@ Design/decision records and a running log of shipped work (items marked
   `gl`/`glg`, `gp`/`gpl`, `gf`), and a nix block (`ns`, `nr`, `nfu`, `nfc`,
   `nsearch`, `ngc`), plus `path` and `reload`. Scope decision: short where it
   helps but **never shadow a real binary** (same rule as rg/fd — the git block
-  deliberately avoids `gs`/ghostscript); system/home rebuilds keep their full
-  `sys-update`/`home-update` names rather than getting cryptic aliases. The set
-  is documented in README §5 (Day-to-day), and `alias` lists them in-shell.
+  deliberately avoids `gs`/ghostscript); lifecycle is `nomarchy-pull` /
+  `nomarchy-rebuild` / `nomarchy-home` (full names on PATH, not aliases). The
+  set is documented in README §5 (Day-to-day), and `alias` lists shell shortcuts.
 - **Theme-switch feedback:** ✓ the "rebuilding…" notification is now
   persistent (timeout 0) and replaced in place by "applied ✓" / failure
   via a synchronous tag, so a multi-minute switch never reads as a failed