feat(ci): eval matrix for opt-in nomarchy.* toggles

nix flake check --no-build only evaluates the four default configs, so a
bug that only fires when a nomarchy.* toggle is flipped sails through —
exactly how the vscode option rename and the impermanence systemd-stage-1
assertion both reached main undetected.

Add bin/utils/nomarchy-eval-matrix: layers each opt-in scenario (16
toggles, both system and home halves) onto nixosConfigurations.default
via extendModules and forces system.build.toplevel.drvPath (which forces
assertion checks); also forces all 21 palettes through the system-side
Plymouth base00->RGB math that the home-only allThemeVariants never
reaches, plus both standalone homeConfigurations. Per-scenario results
come from builtins.tryEval so one failure doesn't mask the rest; verified
it goes red on a re-injected assertion failure and a bad option ref, green
on the current tree.

Wired into .forgejo/workflows/check.yml after flake check (jq via nix
shell so it doesn't depend on the runner image). AGENT.md §5 now tells
future agents to add a scenario when they add/rename an opt-in option.

nomarchy-docs-scripts: filter systemd-service declarations (.services.
nomarchy-) and denylist the eval-matrix repo tool so neither shows as a
dangling "missing" reference; also retroactively clears the latent
nomarchy-flathub-init drift from the gaming-flathub commit.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.forgejo/workflows/check.yml

@@ -7,6 +7,11 @@
 #   3. `docs/SCRIPTS.md` drifts from the repo state because somebody
 #      added / removed / renamed a script and didn't run the generator
 #      (the pre-commit hook handles this, but only when enabled per-clone).
+#   4. An opt-in nomarchy.* toggle stops evaluating. `nix flake check`
+#      only evaluates the four default configs, so a bug that only fires
+#      when a toggle is flipped sails through (e.g. the impermanence
+#      systemd-stage-1 assertion). nomarchy-eval-matrix layers each toggle
+#      onto the default config and forces system.build.toplevel.
 #
 # Doesn't build ISOs — that needs a binary cache. Add a separate job
 # once Cachix/Attic is in place.
@@ -36,6 +41,12 @@ jobs:
       - name: nix flake check --no-build
         run: nix flake check --no-build
 
+      - name: Evaluate opt-in toggle / palette / home matrix
+        # flake check never flips a nomarchy.* toggle; this does. jq is
+        # provided via nix shell so the step doesn't depend on the runner
+        # image preinstalling it.
+        run: nix shell nixpkgs#jq --command ./bin/utils/nomarchy-eval-matrix
+
       - name: Lint nomarchy-* scripts (bash -n + shellcheck)
         run: |
           # Mirror what .githooks/pre-commit runs locally, but across the