feat(nightlight): menu-driven, in-flake on/off (no ~/.local/state)

Night light is off by default and configured entirely through the menu,
writing into the downstream flake instead of ~/.local/state — so the
choice is git-tracked and reproducible across a clone+rebuild.

Two flags under a new settings.* section of the state file (exposed as
the nomarchy.settings option):
- settings.nightlight.installed — sticky, gates the hyprsunset unit;
  nomarchy.nightlight.enable mkDefault-reads it. First enable from the
  menu rebuilds to create the unit (the one accepted rebuild).
- settings.nightlight.on — runtime on/off, toggled instantly
  (theme-sync set --no-switch + systemctl), no rebuild. An ExecCondition
  reads the live flag at session start so an off survives reboot;
  splitting it from the sticky flag means a later unrelated rebuild
  never undoes an instant-off (no decay).

Drops the ~/.local/state/nomarchy/nightlight-off marker and the
ConditionPathExists hack. theme-sync set now skips the wallpaper
re-apply for non-wallpaper keys, and its rebuild notifications are
generic ("changes" not "theme").

First cut of the broader principle — any user-settable config gets a
menu writer that lands it in the flake; no state outside the checkout.
Docs (README §4, ROADMAP, template) updated to reflect it.

Eval- and round-trip-verified; on-hardware check pending.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/ROADMAP.md

@@ -463,25 +463,34 @@ how to override it. Items marked ✓ are shipped.
   drives the HM `services.hyprsunset` with two time-based profiles
   (`sunrise` → identity, `sunset` → `temperature`), so hyprsunset handles the
   schedule and the on-login state. Active-profile-at-session-start was
-  confirmed on hardware (2026-06-18). ✓ **Menu + Waybar toggle:**
-  `nomarchy-nightlight` (in `nightlight.nix`, on PATH) starts/stops the
-  hyprsunset *service* — `systemctl --user is-active` is the single source of
-  truth, the screen restores to true colours when stopped, and it forces the
-  filter off for colour-sensitive work and back on without touching config. A
-  `nomarchy-menu nightlight` entry (System submenu, self-gated on the unit
-  existing) and a self-gating Waybar `custom/nightlight` indicator (moon = on,
-  sun = off; in the generated bar and both summer whole-swaps) drive it.
-  ✓ **Persistent off:** a manual `off` now drops a marker
-  (`~/.local/state/nomarchy/nightlight-off`) and the unit refuses to (re)start
-  while it exists (`Unit.ConditionPathExists=!%h/…`), so an off survives
-  logout/reboot until toggled back on; `on`/toggle-on remove the marker first
-  (a failed condition would otherwise no-op the start). Without the marker the
-  service stays `WantedBy=graphical-session.target` and resumes its schedule at
-  login as before — the session-scoped behaviour is now the *default*, with
-  persistence opt-in via the toggle. Remaining (optional): geo (lat/long) auto
+  confirmed on hardware (2026-06-18). ✓ **Menu + Waybar toggle (opt-in,
+  instant, in-flake state):** two git-tracked keys in the state file, both
+  menu-written (exposed via the new `nomarchy.settings` option) —
+  `settings.nightlight.installed` (**sticky**: gates the hyprsunset unit;
+  `nomarchy.nightlight.enable` `mkDefault`-reads it) and
+  `settings.nightlight.on` (runtime on/off). **Off by default.** The *first*
+  enable from the menu writes `installed` and rebuilds to create the unit (the
+  one accepted rebuild); **every toggle after is instant** —
+  `nomarchy-theme-sync set settings.nightlight.on … --no-switch` (atomic +
+  `git add -N`, no rebuild) plus a `systemctl` start/stop. Splitting the sticky
+  flag from the on/off is what avoids a **decay** bug: an instant-off writes
+  only `on`, so an unrelated later rebuild (e.g. `sys-update`) never drops the
+  unit and "on" stays instant. Persistence across logout/reboot comes from an
+  `ExecCondition` on the unit (`nomarchy-nightlight should-start`) that reads the
+  **live** working-tree on/off at start time — *not* the eval-frozen store copy
+  — so an off survives a reboot with no rebuild; a later rebuild bakes the same
+  value. No more `~/.local/state` marker, no marker `ConditionPathExists`. The
+  `nomarchy-menu` System-submenu entry is always shown (current on/off) so the
+  feature can be enabled from the menu; the self-gating Waybar
+  `custom/nightlight` indicator shows the moon while running and hides otherwise.
+  This is the first cut of a broader principle — **any user-settable config
+  gets a menu writer that lands it in the downstream flake; no state lives
+  outside the checkout** (next target: the per-device keyboard-layout memory
+  below, still in `~/.local/state`; then opt-in auto-commit of the flake on
+  each mutation, owned files only). Remaining (optional): geo (lat/long) auto
   sunset/sunrise (would mean wlsunset, which schedules by location). Pending an
-  on-machine check (off persisting across reboot, and that stopping hyprsunset
-  cleanly restores the gamma).
+  on-machine check (first enable rebuilds + comes on; later toggles instant; off
+  persists across reboot via ExecCondition; stopping hyprsunset restores gamma).
 - **Keyboard layouts (per-device + switching):**
   - ✓ **Per-device declarative layout:** `nomarchy.keyboard.devices`
     (`{ "<hyprctl-device-name>" = { layout; variant; }; }`) generates Hyprland