docs(roadmap): full hardware enablement beyond nixos-hardware

nixos-hardware covers basic per-model enablement, but advanced features
(keyed on CPU/GPU generation) are left to the user. Capture a big item:
extend the installer's autodetection + a nomarchy.hardware.* surface to turn
on safe features automatically (opt-out) and gate the heavy/experimental
ones (opt-in), without per-feature fiddling. Worked example on the ThinkPad
T14s (Ryzen 7 PRO 7840U + Radeon 780M): ROCm (gfx1103 override), Ryzen AI
NPU/XDNA, AMD P-State EPP, VA-API, fprintd biometrics (fwupd already ships),
SSD fstrim.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/ROADMAP.md

@@ -213,6 +213,44 @@ how to override it. Items marked ✓ are shipped.
     whole-swap themes (the same parity the DND bell now has). General
     pattern: any new generated-config module needs adding to the whole-swap
     themes too.
+- **Full hardware enablement (beyond nixos-hardware):** nixos-hardware
+  profiles cover *basic* per-model functionality (quirks, drivers), but the
+  *advanced* features of a machine — keyed more on the CPU/GPU generation
+  than the model — are left for the user to wire up by hand. Close that gap
+  without making it finnicky: extend the installer's existing autodetection
+  (DMI → nixos-hardware profile today; add CPU vendor/arch, GPU, NPU,
+  fingerprint reader, SSD) to switch on the *safe, broadly-beneficial*
+  features automatically, and expose a small `nomarchy.hardware.*` surface
+  (per-vendor where it helps, e.g. `nomarchy.hardware.amd.*`) for the heavy
+  or experimental bits. Goal: full utilisation out of the box — opt-*out* for
+  the safe defaults, opt-*in* for the multi-GB / experimental extras.
+  Complements nixos-hardware (model quirks) rather than replacing it; keep
+  the detection in the installer's `hardware-db` so an installed machine
+  bakes the right defaults, all overridable through `nomarchy.hardware.*`.
+  Worked example — ThinkPad T14s (Ryzen 7 PRO 7840U + Radeon 780M):
+  - **GPU compute — ROCm:** the 780M is an RDNA3 iGPU (gfx1103) ROCm doesn't
+    officially list, so it needs `HSA_OVERRIDE_GFX_VERSION=11.0.0`. Multi-GB
+    closure → opt-in (`nomarchy.hardware.amd.rocm.enable`); unlocks GPU
+    PyTorch / Ollama.
+  - **Ryzen AI NPU (XDNA):** the `amdxdna` kernel driver (mainline 6.14+) +
+    the XRT/xdna userspace runtime + firmware. Niche/experimental → opt-in.
+  - **AMD P-State EPP (Zen 4 power):** `amd_pstate=active` for the EPP
+    governor, which power-profiles-daemon (already shipped, `power.nix`)
+    drives per profile. Broadly beneficial on Zen 2+ → default on when the
+    installer sees an AMD CPU.
+  - **Hardware video acceleration (VA-API):** mesa's radeonsi exposes VA-API
+    on AMD (`LIBVA_DRIVER_NAME=radeonsi`, libva + drivers in
+    `hardware.graphics.extraPackages`); Intel uses `intel-media-driver`.
+    Broadly beneficial → default on, vendor-detected.
+  - **LVFS firmware & biometrics:** fwupd already ships (✓, `services.fwupd`).
+    Add fingerprint: `services.fprintd` when a reader is detected, with
+    opt-in PAM integration for login/sudo (password-only stays the default
+    for the cautious).
+  - **SSD periodic TRIM:** `services.fstrim.enable` (weekly) — safe and
+    beneficial, so default on (trivial enough it may warrant being
+    distro-wide regardless).
+  Sub-items here can graduate into their own roadmap entries as they're
+  scoped; the unifying work is the detection + `nomarchy.hardware.*` surface.
 - **Opt-in services & integrations:** the counterpart to the opt-*out*
   application suite above — heavier or more personal integrations shipped
   **off by default**, each a `nomarchy.services.<name>.enable` toggle a