feat(session): first-boot welcome toast (#81)

One-shot user unit fires a dismissible "You're set" notification on the
first graphical session (SUPER+M / SUPER+T / SUPER+? + Network + Doctor),
then writes settings.firstBootShown into the flake checkout. Skips the
live ISO hostname (hosts/live.nix keeps its own toast). Toggle:
nomarchy.firstBootWelcome.enable. checks.first-boot covers the gate.

Verified: V2 — flake check --no-build; checks.first-boot green; local
shim smoke; downstream-template-home ships the unit.

docs/ROADMAP.md

@@ -369,6 +369,13 @@ Design/decision records and a running log of shipped work (items marked
   peripherals). Self-gates when attrs missing; soft warn below 70% of
   design. `NOMARCHY_POWER_SUPPLY_ROOT` for the `checks.doctor` fixture
   (`test_power` has no cycle/design attrs).
+  ✓ **First-boot welcome toast (#81, `VISION § B`):** oneshot user unit
+  `nomarchy-first-boot` fires a dismissible “You're set” notify (SUPER+M /
+  SUPER+T / SUPER+? + Network + Doctor pointer) once, then writes
+  `settings.firstBootShown` into the flake checkout (`--no-switch`). Skips
+  `hostname == nomarchy-live` (live ISO keeps its own welcome). Toggle:
+  `nomarchy.firstBootWelcome.enable`. `checks.first-boot` gates toast /
+  marker / re-run silence / live skip.
 - ✓ **Hibernate double-unlock:** on resume from hibernate the LUKS
   passphrase already gates the machine, but locking hyprlock before sleep
   meant a second password. Fixed by *not locking* before an encrypted

docs/VISION.md

@@ -69,7 +69,7 @@ Reference: [HARDWARE.md](HARDWARE.md) §4–§5, §10.
 
 | Idea | Intent | Notes |
 |------|--------|-------|
-| **Silent first-week card** | One dismissible “you’re set” (menu, theme, wallpaper, network) — not a wizard | Prefer notify or doctor “first boot” section |
+| **Silent first-week card** ✓ | One dismissible “you’re set” (menu, themes, keys, network) — not a wizard | ✓ shipped #81 — `settings.firstBootShown` + notify; live ISO keeps its own toast |
 | **Boreal as default** | Identity on first boot | BACKLOG PROPOSED already |
 | **Generation readability** | “What changed last rebuild” in plain language | Rollback exists; story is incomplete |
 | **Post-install hints** | One-shot MOTD/notify for fwupd / fprintd when relevant | Avoid permanent nag |