feat(updates): passive update-awareness indicator + notification

Add opt-in nomarchy.updates (modules/home/updates.nix): a nomarchy-updates
checker on a systemd user timer (interval, default daily) that surfaces a
Waybar indicator + a notification when updates are available, without ever
changing anything (you still run sys-update / flatpak update).

It counts:
- flake inputs behind upstream — only the flake's DIRECT inputs (root.inputs:
  nixpkgs, the Nomarchy input, home-manager, stylix…), not the transitive
  closure, via `git ls-remote` vs the locked rev. Offline → skipped, never a
  false alarm.
- Flatpak updates, when the flatpak CLI is present (.flatpak, gated on
  services.flatpak being on) — Bernardo's suggestion.

Waybar custom/updates self-gates (hidden until the timer finds something;
accent "󰚰 N", signal 9 for instant refresh), in the generated bar and both
summer whole-swaps. The notification fires only when the count grows, so a
daily timer doesn't nag. Click → the upgrade flow in a terminal (sys-update /
flatpak update, each confirmed). nomarchy-updates ships always on PATH and
self-gates so the static whole-swap bars can exec it even when the feature
is off.

Verified: flake check clean; home generation builds; the jq direct-input
filter + status self-gate exercised against the real flake.lock; script
passes bash -n. Pending an on-machine check (ls-remote/notify/timer need a
live session).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/ROADMAP.md

@@ -491,10 +491,19 @@ how to override it. Items marked ✓ are shipped.
     **Pending an on-machine check of the restore/rollback paths.**
   - Remaining (optional): boot-from-snapshot needs a systemd-boot equivalent
     of grub-btrfs.
-- **Update awareness:** updates are manual today (`sys-update`/`home-update`);
-  add a Waybar indicator / notification when flake inputs are stale or a new
-  nixpkgs rev is available (optionally with a pending-change count). Augments,
-  never replaces, the explicit rebuild flow.
+- ✓ **Update awareness:** `nomarchy.updates.enable` (opt-in, `modules/home/
+  updates.nix`) — a `nomarchy-updates` checker on a systemd user timer
+  (`.interval`, default daily) compares each **direct** branch-tracking flake
+  input (nixpkgs, the Nomarchy input, home-manager, stylix … via `git
+  ls-remote` vs the locked rev; offline → skipped, no false alarm) and, when
+  the `flatpak` CLI is present (`.flatpak`), counts Flatpak updates. A
+  self-gating Waybar `custom/updates` indicator (hidden until something's
+  available; accent `󰚰 N`, signal-refreshed) + a notification that fires only
+  when the count *grows* (so a daily timer never nags). Click → the upgrade
+  flow in a terminal (`sys-update` / `flatpak update`, each confirmed). Purely
+  passive — it never changes anything, augmenting the explicit rebuild flow.
+  Indicator is in the generated bar and both summer whole-swaps. **Pending an
+  on-machine check** (the ls-remote/notify/timer path needs a live session).
 - **"nomarchy" control center:** a single TUI/GUI front-end over the common
   toggles — theme, power profile, opt-in services, display, DND — built on
   the same `nomarchy-theme-sync` / `nomarchy.*` surface the menu already