feat(cli): nomarchy-pull / nomarchy-rebuild / nomarchy-home

Split lifecycle into three clear commands (user pick):
  nomarchy-pull     git pull (if checkout) + flake.lock update
  nomarchy-rebuild  system switch on current lock (snap + nvd)
  nomarchy-home     Home Manager switch

Full upgrade: pull && rebuild && home. Legacy sys-update / sys-rebuild /
home-update remain as wrappers. nixos-rebuild-snap uses NOMARCHY_PATH.

V0: flake check --no-build green.

modules/home/rofi.nix

@@ -798,7 +798,7 @@ ${themeRows}
               fi
             fi
             nomarchy-theme-sync --quiet set settings.fingerprint.pam "$new" --no-switch
-            notify-send "Fingerprint" "Use for login: $new — applies on next sys-rebuild."
+            notify-send "Fingerprint" "Use for login: $new — applies on next nomarchy-rebuild."
             ;;
         esac ;;
 
@@ -843,7 +843,7 @@ ${themeRows}
               printf 'Enter to close.'; read -r _" ;;
           *Snapshots*) exec "$0" snapshot ;;
           *"older generation"*)
-            notify-send "System rollback" "Reboot and pick an older NixOS generation in the boot menu (the last 10 are kept). Make it stick: revert the change in ~/.nomarchy, then sys-rebuild. Details: docs/RECOVERY.md §3." ;;
+            notify-send "System rollback" "Reboot and pick an older NixOS generation in the boot menu (the last 10 are kept). Make it stick: revert the change in ~/.nomarchy, then nomarchy-rebuild. Details: docs/RECOVERY.md §3." ;;
         esac ;;
 
       tools)