feat(update): sys-update/sys-rebuild end with an nvd what-changed diff (item 9a)

The informative half of 'informative + rock-stable': both rebuild
wrappers capture /run/current-system before the switch and print a
package-level nvd diff after it — store-path-pinned so no PATH
dependence, || true so an ornamental diff can never fail a succeeded
rebuild, and an identical-path fast-path says 'no changes'. README §3
notes it. V1: template-system toplevel rebuilt, generated scripts
bash -n clean, nvd smoke-run against the real closure.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

agent/BACKLOG.md

@@ -28,15 +28,15 @@ next, in what order*.
 
 ### 9. Update & rollback UX
 New; extends the update-awareness story to the other half: what changed,
-and how do I get back. (a) `sys-update` prints a human diff of what the
-update changed (`nvd diff` between system generations, or `nix store
-diff-closures`); (b) a **System → Rollback** menu flow: desktop = pick a
-recent `home-manager generations` entry and activate it (the theme
-history is already generations); system = point at the boot-menu
-generation flow + `nomarchy-snapshots` rather than reimplementing it —
-destructive steps keep the typed-`yes` gate. **Why:** informative +
-rock-stable means undo is one menu away, not a Nix lesson. **Verify:**
-V1; V2 for the generation-activate path in a VM.
+and how do I get back. Done: (a) `sys-update` AND `sys-rebuild` end with
+an `nvd diff` of old→new generation (store-path-pinned; never fails the
+run; "no changes" fast-path). Remaining: (b) a **System → Rollback**
+menu flow: desktop = pick a recent `home-manager generations` entry and
+activate it (the theme history is already generations); system = point
+at the boot-menu generation flow + `nomarchy-snapshots` rather than
+reimplementing it — destructive steps keep the typed-`yes` gate.
+**Why:** informative + rock-stable means undo is one menu away, not a
+Nix lesson. **Verify:** V1; V2 for the generation-activate path in a VM.
 
 ### 10. `nomarchy-doctor` — one-shot health check
 New. A single command (+ System-menu entry) that checks the things that