feat(ci): eval matrix for opt-in nomarchy.* toggles

nix flake check --no-build only evaluates the four default configs, so a
bug that only fires when a nomarchy.* toggle is flipped sails through —
exactly how the vscode option rename and the impermanence systemd-stage-1
assertion both reached main undetected.

Add bin/utils/nomarchy-eval-matrix: layers each opt-in scenario (16
toggles, both system and home halves) onto nixosConfigurations.default
via extendModules and forces system.build.toplevel.drvPath (which forces
assertion checks); also forces all 21 palettes through the system-side
Plymouth base00->RGB math that the home-only allThemeVariants never
reaches, plus both standalone homeConfigurations. Per-scenario results
come from builtins.tryEval so one failure doesn't mask the rest; verified
it goes red on a re-injected assertion failure and a bad option ref, green
on the current tree.

Wired into .forgejo/workflows/check.yml after flake check (jq via nix
shell so it doesn't depend on the runner image). AGENT.md §5 now tells
future agents to add a scenario when they add/rename an opt-in option.

nomarchy-docs-scripts: filter systemd-service declarations (.services.
nomarchy-) and denylist the eval-matrix repo tool so neither shows as a
dangling "missing" reference; also retroactively clears the latent
nomarchy-flathub-init drift from the gaming-flathub commit.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

bin/utils/nomarchy-docs-scripts

@@ -98,10 +98,12 @@ all_refs=$(grep -rhE 'nomarchy-[a-z0-9]([a-z0-9-]*[a-z0-9])?' \
               -e '\./result/bin/run-nomarchy-' \
               -e 'mktemp[[:space:]]+[^|]*-t[[:space:]]+nomarchy-' \
               -e '(TIMER_NAME|NOPASSWD_FILE|UNIT_NAME)=.*nomarchy-' \
+              -e '\.services\.nomarchy-' \
               -e 'docker[[:space:]]+[^|]*nomarchy-' \
           | grep -oE 'nomarchy-[a-z0-9]([a-z0-9-]*[a-z0-9])?' \
           | grep -vE '^(nomarchy-launch|nomarchy-brightness|nomarchy-cmd|nomarchy-pkg|nomarchy-restart|nomarchy-toggle|nomarchy-theme|nomarchy-webapp-handler|nomarchy-font-selector|nomarchy-theme-selector|nomarchy-wallpaper-selector|nomarchy-setup|nomarchy-refresh|nomarchy-scripts|nomarchy-system-scripts|nomarchy-theme-engine-scripts)$' \
           | grep -vE '^(nomarchy-plymouth|nomarchy-sddm-theme|nomarchy-live|nomarchy-rev|nomarchy-windows)$' \
+          | grep -vE '^(nomarchy-eval-matrix)$' \
           | sort -u)
 # The second denylist covers identifiers whose ambiguity survives the line
 # filter: `nomarchy-plymouth` / `nomarchy-sddm-theme` are Nix derivation
@@ -109,6 +111,9 @@ all_refs=$(grep -rhE 'nomarchy-[a-z0-9]([a-z0-9-]*[a-z0-9])?' \
 # ISO label that shows up in comments, `nomarchy-rev` is `/etc/nomarchy-rev`
 # (written by the ISO), and `nomarchy-windows` is a docker container name
 # in compose heredocs.
+# The third denylist: `nomarchy-eval-matrix` is a bin/utils repo tool (like
+# this generator) that names itself in its own header comment — not a
+# user-facing script that ships in nomarchy-system-scripts.
 
 # --- Render: header --------------------------------------------------------