feat(updates): passive update-awareness indicator + notification

Add opt-in nomarchy.updates (modules/home/updates.nix): a nomarchy-updates
checker on a systemd user timer (interval, default daily) that surfaces a
Waybar indicator + a notification when updates are available, without ever
changing anything (you still run sys-update / flatpak update).

It counts:
- flake inputs behind upstream — only the flake's DIRECT inputs (root.inputs:
  nixpkgs, the Nomarchy input, home-manager, stylix…), not the transitive
  closure, via `git ls-remote` vs the locked rev. Offline → skipped, never a
  false alarm.
- Flatpak updates, when the flatpak CLI is present (.flatpak, gated on
  services.flatpak being on) — Bernardo's suggestion.

Waybar custom/updates self-gates (hidden until the timer finds something;
accent "󰚰 N", signal 9 for instant refresh), in the generated bar and both
summer whole-swaps. The notification fires only when the count grows, so a
daily timer doesn't nag. Click → the upgrade flow in a terminal (sys-update /
flatpak update, each confirmed). nomarchy-updates ships always on PATH and
self-gates so the static whole-swap bars can exec it even when the feature
is off.

Verified: flake check clean; home generation builds; the jq direct-input
filter + status self-gate exercised against the real flake.lock; script
passes bash -n. Pending an on-machine check (ls-remote/notify/timer need a
live session).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

templates/downstream/home.nix

@@ -22,6 +22,12 @@
   #   sunrise = "07:00";
   # };
   #
+  # nomarchy.updates = {                # passive update-awareness indicator + notification
+  #   enable = true;
+  #   interval = "daily";               #   how often to check (systemd OnCalendar)
+  #   flatpak = true;                   #   also count Flatpak updates when flatpak is on
+  # };
+  #
   # nomarchy.monitors = [               # declarative per-output layout, hotplug-applied
   #   { name = "eDP-1"; position = "0x0"; }
   #   { name = "HDMI-A-1"; position = "auto-right"; }