feat(lifecycle): auto-commit sweep of the machine flake before pull/rebuild/home

With settings.autoCommit on, only menu/theme mutations were committed
(theme-sync pathspec-limits to theme-state.json by design), so hand
edits to system.nix/home.nix and lock bumps stayed forever-dirty.

New internal nomarchy-autocommit (nomarchy-lifecycle): live-reads the
same flag, commits everything dirty as "nomarchy: auto-commit before
<pull|rebuild|home switch>" with the swept file list in the body,
fallback identity, never fatal (|| true at call sites). Called at the
top of all three lifecycle commands; before the ff-only pull it also
un-dirties the tree. Exposed via passthru.autocommit + package export;
guarded by checks.lifecycle-autocommit (sandbox repos: sweep, no-op on
clean/off/non-repo). Sync sweep: README, RECOVERY, ROADMAP, rofi
toggle, control-center prompt, theme-sync docstring, JOURNAL.

Verified: V1+ — flake check --no-build green; the new check builds;
end-to-end run of the built nomarchy-rebuild (stubbed sudo/rebuild)
against a copy of a real dirty ~/.nomarchy: 4 files → one commit,
clean tree. No VM boot — no session-visible surface.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/RECOVERY.md

@@ -30,8 +30,10 @@ boreal` (or any preset). If a switch failed halfway, the state file is written
 `home-manager switch --flake ~/.nomarchy` (or `nomarchy-home`).
 
 Your flake checkout is a git repo, and with auto-commit enabled every
-apply is a commit: `git -C ~/.nomarchy log` to see what changed,
-`git revert` the culprit, then `nomarchy-home`.
+apply is a commit — and every `nomarchy-pull`/`-rebuild`/`-home` first
+sweeps pending hand edits into one, so history mirrors your generations:
+`git -C ~/.nomarchy log` to see what changed, `git revert` the culprit,
+then `nomarchy-home`.
 
 ## 2. The desktop won't start at all
 

docs/ROADMAP.md

@@ -960,6 +960,18 @@ Design/decision records and a running log of shipped work (items marked
   `get` now prints booleans JSON-style (`true`, not Python's `True`) —
   which also un-sticks the System menu's "Auto timezone (on/off)" label,
   whose `= true` comparison could never match before.
+- ✓ **Auto-commit sweep before switch (2026-07-12):** the pathspec limit
+  above left hand edits (system.nix/home.nix, lock bumps) forever-dirty
+  even with `settings.autoCommit` on. Now `nomarchy-pull`/`-rebuild`/
+  `-home` run `nomarchy-autocommit` (internal, in nomarchy-lifecycle)
+  first: same live-read flag, commits *everything* dirty with an honest
+  `nomarchy: auto-commit before <pull|rebuild|home switch>` message whose
+  body lists the swept files — so `git log` mirrors the generation list
+  and hand edits still never ride a settings-named commit. Same fallback
+  identity; never fatal (`|| true` at the call sites — a git hiccup can't
+  block a rebuild); before the ff-only pull, it also un-dirties the tree.
+  Guarded by `checks.lifecycle-autocommit` (sandbox-repo round trip of
+  the real binary: sweep, no-op on clean/off/non-repo).
 - **"nomarchy" control center:** a single TUI/GUI front-end over the common
   toggles — theme, power profile, opt-in services, display, DND — built on
   the same `nomarchy-theme-sync` / `nomarchy.*` surface the menu already