test(auto-theme): #79 V2 — simulate sunset in a VM (was mis-framed V3)

Bernardo rightly pushed back on deferring #79 to a real session: a
simulated sunset IS VM-testable. Add checks.auto-theme, a runNixOSTest
that installs nomarchy-theme-sync, points NOMARCHY_DEFAULT_THEMES at the
presets, stubs the rebuild via NOMARCHY_REBUILD (a marker), configures
the day/night pair + schedule, then WALKS THE VM CLOCK across the
boundary: 19:55 -> 20:05 -> 20:06 -> next-day 07:30, asserting the active
theme goes summer-day -> night (1 rebuild) -> night (idempotent, still 1)
-> day (2 rebuilds).

This isolates the auto decision + apply + rebuild-trigger; the actual
home-manager switch is stubbed (that generic apply path is exercised by
every manual theme change). The only on-hardware residual is the user
timer firing on its OnCalendar schedule, which systemd-analyze validates.

#79 drops its [blocked:hw] tag — it's V2-verified. ROADMAP updated;
lesson recorded in MEMORY (don't default timer/session features to V3:
stub the generic step, simulate the clock).

Verification: V2 PASS (nix build .#checks.x86_64-linux.auto-theme, fresh,
exit 0); V0 flake check green.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agent/MEMORY.md

@@ -25,6 +25,16 @@ iteration would otherwise rediscover.
 - In VM tests `pgrep -f PATTERN` can match the test backdoor's own
   `bash -c` wrapper (the pattern is in its cmdline) — use `pgrep -x`
   or a `[t]uigreet`-style bracket pattern.
+- **Don't default a "timer/session" feature to V3 — most of it is VM-testable.**
+  A scheduled/session behaviour usually decomposes into a *generic* step
+  already covered elsewhere (e.g. `home-manager switch`, exercised by every
+  theme apply) and a *specific* decision (which theme, when). Stub the generic
+  step (`NOMARCHY_REBUILD=<marker>` for theme-sync) and **simulate time by
+  moving the VM clock** (`date -s`, `timedatectl set-ntp false`, `time.timeZone
+  = "UTC"`), then assert the decision + state change headlessly. `checks.auto-theme`
+  does exactly this for #79's sunset/sunrise. Only the literal
+  timer-fires-on-`OnCalendar` is truly on-hardware, and `systemd-analyze
+  calendar` validates that schedule. (I first mis-framed #79 as V3 — it's V2.)
 - **`writeShellScriptBin` scripts run `set -euo pipefail`** (nomarchy-doctor,
   the menu, lifecycle CLIs). So a **no-match `grep` inside `$(…)`** (grep exits
   1 → command-sub fails → abort) and a **standalone `cond && action`** (false