feat(update): sys-update/sys-rebuild end with an nvd what-changed diff (item 9a)

The informative half of 'informative + rock-stable': both rebuild
wrappers capture /run/current-system before the switch and print a
package-level nvd diff after it — store-path-pinned so no PATH
dependence, || true so an ornamental diff can never fail a succeeded
rebuild, and an identical-path fast-path says 'no changes'. README §3
notes it. V1: template-system toplevel rebuilt, generated scripts
bash -n clean, nvd smoke-run against the real closure.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

README.md

@@ -172,6 +172,7 @@ Day-to-day you'll use the shipped shortcuts instead:
 ```sh
 sys-update    # nix flake update + system rebuild (BTRFS snapshot first when available)
 sys-rebuild   # system rebuild against the CURRENT lock (config changes only, no update)
+              # …both end with a package-level diff of what the rebuild changed (nvd)
 home-update   # home-manager switch (no flake update, no sudo)
 ```