feat(session): first-boot welcome toast (#81)

One-shot user unit fires a dismissible "You're set" notification on the
first graphical session (SUPER+M / SUPER+T / SUPER+? + Network + Doctor),
then writes settings.firstBootShown into the flake checkout. Skips the
live ISO hostname (hosts/live.nix keeps its own toast). Toggle:
nomarchy.firstBootWelcome.enable. checks.first-boot covers the gate.

Verified: V2 — flake check --no-build; checks.first-boot green; local
shim smoke; downstream-template-home ships the unit.

agent/BACKLOG.md

@@ -55,13 +55,6 @@ runtime-computed `resume_offset` into the boot cmdline, and the dev box runs
 exactly this layout (`/proc/cmdline` verified) but isn't Nomarchy. Steps in
 HARDWARE-QUEUE. Close #76 on PASS.
 
-### 81. First-boot welcome card (`VISION § B`)
-One dismissible "you're set" toast on the first session (SUPER+M menu,
-SUPER+T themes, SUPER+? keys, network pointer) — a notification, **not**
-a wizard. Needs a one-shot marker that respects "no state outside the
-checkout": key off HM generation №1 or a `settings.firstBootShown`
-write. VM assert on the gate.
-
 ### 82. Generation readability (`VISION § B`)
 "What changed last rebuild" in plain language: post-switch `nvd` /
 `nix store diff-closures` summary (n packages up/down/added) surfaced
@@ -140,9 +133,9 @@ high-ROI, etc.) live in the journal + ROADMAP — not here.*
   2026-07-10). Keep #59 commented install guidance; no
   `nomarchy.hardware.nvidia.*` until a hybrid maintainer + queue.
 
-_(#80 battery health shipped 2026-07-11. Remaining promoted: first-boot
-  card, generation readability, pre-activate flag, dock life, hall of
-  fame → **NEXT #81–#85**.)_
+_(#80 battery health + #81 first-boot welcome shipped 2026-07-11.
+  Remaining promoted: generation readability, pre-activate flag, dock
+  life, hall of fame → **NEXT #82–#85**.)_
 
 ### v1.0 pointer