feat(session): first-boot welcome toast (#81)

One-shot user unit fires a dismissible "You're set" notification on the
first graphical session (SUPER+M / SUPER+T / SUPER+? + Network + Doctor),
then writes settings.firstBootShown into the flake checkout. Skips the
live ISO hostname (hosts/live.nix keeps its own toast). Toggle:
nomarchy.firstBootWelcome.enable. checks.first-boot covers the gate.

Verified: V2 — flake check --no-build; checks.first-boot green; local
shim smoke; downstream-template-home ships the unit.

pkgs/nomarchy-first-boot/default.nix

@@ -0,0 +1,11 @@
+# First-session "you're set" toast (nomarchy.firstBootWelcome). A package
+# so checks.first-boot can exercise the gate on a minimal node — same
+# pattern as nomarchy-battery-notify. libnotify + theme-sync stay on PATH
+# (user unit / VM shim), not runtimeInputs.
+{ writeShellApplication, coreutils }:
+
+writeShellApplication {
+  name = "nomarchy-first-boot";
+  runtimeInputs = [ coreutils ];
+  text = builtins.readFile ./nomarchy-first-boot.sh;
+}

pkgs/nomarchy-first-boot/nomarchy-first-boot.sh

@@ -0,0 +1,34 @@
+# nomarchy-first-boot — one-shot "you're set" toast on the first session.
+# Marker is settings.firstBootShown in the flake's theme-state.json
+# (in-checkout state; never ~/.local/state). notify-send and
+# nomarchy-theme-sync come from PATH so the VM check can shim them.
+
+# Live ISO already has its own welcome (hosts/live.nix); skip there so
+# users aren't double-toasted and the live seed doesn't get a sticky
+# firstBootShown write every boot.
+# uname -n is coreutils; avoid depending on a separate hostname package.
+hn=$(uname -n 2>/dev/null || true)
+if [ "$hn" = nomarchy-live ]; then
+  exit 0
+fi
+
+# Already shown → silent. Missing key / no checkout → treat as not shown
+# (theme-sync get exits non-zero when the key is absent).
+shown=$(nomarchy-theme-sync get settings.firstBootShown 2>/dev/null || true)
+case "$shown" in
+  true|1|yes) exit 0 ;;
+esac
+
+# Dismissible sheet, not a wizard. Body lines match SUPER+? mnemonics.
+notify-send -a Nomarchy -u normal -t 0 \
+  "You're set" \
+  "SUPER+M  menu · SUPER+T  themes · SUPER+?  keys
+Wi‑Fi: System › Network (or the bar tray)
+Anything off? System › Doctor"
+
+# Persist in the checkout so re-login is silent. --no-switch: marker only.
+if ! nomarchy-theme-sync --quiet set settings.firstBootShown true --no-switch; then
+  # No writable flake checkout (or tool missing) — still showed the toast;
+  # without a marker it may reappear next login. Don't fail the unit.
+  exit 0
+fi