feat(stability): default-on memory-pressure protection (earlyoom)

modules/nixos/oom.nix — running out of memory now kills the offending
process (with a desktop notification via systembus-notify) instead of
freezing the desktop for minutes until the kernel OOM killer fires.

earlyoom over systemd-oomd, deliberately: oomd kills whole cgroups,
and a Hyprland session runs as ONE scope (nothing here spawns per-app
systemd scopes, unlike GNOME) — under pressure oomd would take out the
entire desktop to save it. earlyoom kills the single largest process
before the thrash point. nixpkgs default-enables oomd in an inert
state (no slices monitored); it is disabled outright so there is one
owner. Session plumbing is --avoid-listed (unanchored — NixOS wrappers
rename comm to .foo-wrapped); no --prefer tuning, largest-RSS
selection already finds the hog. All mkDefault; opt out with
services.earlyoom.enable = false (README note added).

Verified: V0 (flake check) + V2 — new checks.oom-protection
runNixOSTest, executed: a chunked allocator (686 MB peak, 1 GB VM) is
SIGTERM'd by earlyoom in 0.1 s, a bystander unit survives (the
process-level granularity the module exists for), and systemd-oomd is
asserted inactive. 25 s runtime.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

agent/BACKLOG.md

@@ -35,19 +35,6 @@ likely failure mode; the legacy repo OOM'd on heavy evals). **Stretch
 `nix-kvm`, host mode) unlocks the workflow's commented `vm-checks` job
 — the VM suite + real builds in CI (upgrades half of item 14 free).
 
-### 3. Memory-pressure protection (no more frozen desktops)
-New. A workstation that compiles from source *will* hit memory
-exhaustion (the discarded release bump died to a Hyprland OOM; a big
-`nix build` can freeze the session today — nothing mitigates OOM).
-Ship a default-on userspace OOM killer: pick `systemd-oomd`
-(`systemd.oomd` + the NixOS enables for user slices) or `earlyoom` —
-write the choice + rationale into the commit; consider protecting the
-session (Hyprland/greetd) and sacrificing `nix-daemon` build slices
-first. **Why:** "rock-stable" means the UI never locks up. **Done
-when:** on by default (`lib.mkDefault`), overridable natively; the
-choice documented in README's "beyond the surface" note. **Verify:**
-V2 — a VM check that memory pressure kills the hog, not the session.
-
 ### 4. btrfs-assistant segfault — attempt the nixpkgs override fix
 ROADMAP § Snapshot browse/restore. btrfs-assistant 2.2 crashes in
 `libbtrfsutil.so.1.4.0` (ABI mismatch, confirmed not a VM artifact); the