docs(options): README tables reconciled + permanent option-docs check (item 6a)

Slice (a) of the docs review: 9 undocumented nomarchy.* options got
README rows or inline .leaf mentions (autoTimezone, camera IR-hide,
intel.guc, amd.pstate/vaapi, package, system.stateFile, restic.paths).
The diff is now a flake check: option names are eval-walked from the
four option-declaring modules (config halves stay lazy) and compared
to the tables by tools/check-option-docs.py — undocumented options and
stale table rows both fail. Negative-tested against the pre-fix README
(reports exactly the 9 gaps). Item 6 split into slices a–d in BACKLOG.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

flake.nix

@@ -147,6 +147,42 @@
               touch $out
             '';
 
+          # The README option tables must track the live `nomarchy.*`
+          # surface. The surface is walked at eval time from the four
+          # option-declaring modules (their lazy `config` halves stay
+          # unevaluated), so the live side of the diff can't go stale;
+          # the script wants a table row per option (inline `.leaf`
+          # mentions ok for non-enable sub-knobs) and flags stale rows.
+          option-docs =
+            let
+              lib = nixpkgs.lib;
+              names = prefix: opts: lib.concatLists (lib.mapAttrsToList
+                (n: v:
+                  if lib.isOption v
+                  then lib.optional (!(v.readOnly or false)) "${prefix}${n}"
+                  else names "${prefix}${n}." v)
+                opts);
+              surface = lib.concatLists [
+                (names "nomarchy."
+                  ((import ./modules/home/options.nix { inherit lib pkgs; }).options.nomarchy))
+                (names "nomarchy.system."
+                  ((import ./modules/nixos/options.nix { inherit lib; }).options.nomarchy.system))
+                (names "nomarchy.hardware."
+                  ((import ./modules/nixos/hardware.nix { inherit lib pkgs; config = { }; }).options.nomarchy.hardware))
+                (names "nomarchy.services."
+                  ((import ./modules/nixos/services.nix { inherit lib pkgs; config = { }; }).options.nomarchy.services))
+              ];
+            in
+            pkgs.runCommand "nomarchy-option-docs"
+              { nativeBuildInputs = [ pkgs.python3 ]; }
+              ''
+                python3 ${./tools/check-option-docs.py} \
+                  ${pkgs.writeText "option-surface.txt"
+                    (lib.concatStringsSep "\n" surface + "\n")} \
+                  ${./README.md}
+                touch $out
+              '';
+
           # Config-level VM assertions for the nomarchy.hardware.* toggles —
           # what they SET (kernel cmdline, fprintd, PAM). Real hardware
           # behaviour (firmware/driver/device) needs bare metal and is out of