feat(update): sys-update/sys-rebuild end with an nvd what-changed diff (item 9a)

The informative half of 'informative + rock-stable': both rebuild
wrappers capture /run/current-system before the switch and print a
package-level nvd diff after it — store-path-pinned so no PATH
dependence, || true so an ornamental diff can never fail a succeeded
rebuild, and an identical-path fast-path says 'no changes'. README §3
notes it. V1: template-system toplevel rebuilt, generated scripts
bash -n clean, nvd smoke-run against the real closure.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

agent/JOURNAL.md

@@ -17,6 +17,22 @@ Template:
 
 ---
 
+## 2026-07-04 — sys-update/-rebuild what-changed diff (iteration #18, item 9a)
+- **Task:** BACKLOG NEXT#9 half (a) — a human diff after system rebuilds.
+- **Did:** both sys-update and sys-rebuild (twins stay twins) capture
+  /run/current-system before, and after the switch print
+  `nvd diff before after` (store-path-pinned ${"$"}{pkgs.nvd}, `|| true`
+  so it can't fail a succeeded rebuild; identical-path fast-path says
+  "no changes"). README §3 shortcut block notes it.
+- **Verified:** V0; V1 — template-system toplevel rebuilt, generated
+  scripts extracted + bash -n, nvd smoke-run against the real closure
+  (correct output format). Runtime behaviour is a trivial shell path —
+  no VM needed.
+- **Pending:** half (b) — the System → Rollback menu flow (desktop
+  generations picker; system → boot menu + snapshots pointer).
+- **Next suggestion:** item 9b — it completes the item; V2 the
+  generation-activate path.
+
 ## 2026-07-04 — viewers + mime defaults (iteration #17, item 8)
 - **Task:** BACKLOG NEXT#8 — PDF/image viewers + xdg-mime defaults.
 - **Did:** modules/home/viewers.nix (`nomarchy.viewers.enable`, default