feat(session): first-boot welcome toast (#81)

One-shot user unit fires a dismissible "You're set" notification on the
first graphical session (SUPER+M / SUPER+T / SUPER+? + Network + Doctor),
then writes settings.firstBootShown into the flake checkout. Skips the
live ISO hostname (hosts/live.nix keeps its own toast). Toggle:
nomarchy.firstBootWelcome.enable. checks.first-boot covers the gate.

Verified: V2 — flake check --no-build; checks.first-boot green; local
shim smoke; downstream-template-home ships the unit.

docs/ROADMAP.md

@@ -369,6 +369,13 @@ Design/decision records and a running log of shipped work (items marked
   peripherals). Self-gates when attrs missing; soft warn below 70% of
   design. `NOMARCHY_POWER_SUPPLY_ROOT` for the `checks.doctor` fixture
   (`test_power` has no cycle/design attrs).
+  ✓ **First-boot welcome toast (#81, `VISION § B`):** oneshot user unit
+  `nomarchy-first-boot` fires a dismissible “You're set” notify (SUPER+M /
+  SUPER+T / SUPER+? + Network + Doctor pointer) once, then writes
+  `settings.firstBootShown` into the flake checkout (`--no-switch`). Skips
+  `hostname == nomarchy-live` (live ISO keeps its own welcome). Toggle:
+  `nomarchy.firstBootWelcome.enable`. `checks.first-boot` gates toast /
+  marker / re-run silence / live skip.
 - ✓ **Hibernate double-unlock:** on resume from hibernate the LUKS
   passphrase already gates the machine, but locking hyprlock before sleep
   meant a second password. Fixed by *not locking* before an encrypted