feat(first-boot): post-install hardware hints — one self-gated toast, once

After the #81 "you're set" card, at most one additional "Hardware tips"
toast: a Firmware line when fwupdmgr is on PATH, a Fingerprint line when
fprintd-list is (VISION § B). One-shot marker settings.hardwareHintsShown,
in-checkout like firstBootShown. When no tooling matches, the marker is
deliberately left unset — the re-check costs a command -v per session,
and a later-enabled fwupd or newly-added reader still gets its hint once.
Never a permanent nag; live-ISO gate covers the new stage too.

Lives inside nomarchy-first-boot: the card's semantics are unchanged
(retry loop, exit 1 so a failed notify retries next login, marker only
after success); hints run only once the card has landed. Docs: README
option row, HARDWARE.md hint paragraphs, VISION § B checked off.

Verification: V2 — shellcheck clean, nix flake check --no-build green,
nix build .#checks.x86_64-linux.first-boot green (bare node silent →
fwupdmgr appears → fires once → silent again → live-ISO still skips).
Real toast rendering is the same session surface as the proven #81 card.
Implementation by a Sonnet subagent; design and review on Fable.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

agent/BACKLOG.md

@@ -316,17 +316,6 @@ offline ISO's behaviour untouched (`checks.*` for the offline path stay green).
   2026-07-10). Keep #59 commented install guidance; no
   `nomarchy.hardware.nvidia.*` until a hybrid maintainer + queue.
 
-- **Post-install hardware hints** (`VISION § B`) — After the general
-  “you're set” card (#81), optionally fire **one** additional
-  self-gated notify when the machine actually has the hardware:
-  (a) `fwupdmgr` on PATH → “System › Firmware to check LVFS updates”;
-  (b) `fprintd-list` on PATH → “System › Fingerprint to enroll”.
-  One-shot markers in `settings.*` (same in-checkout discipline as
-  `firstBootShown`); never a permanent MOTD nag. Cost: small — extend
-  `nomarchy-first-boot` or a sibling oneshot + `checks.first-boot`
-  fixture. Control-center / MOTD already mention these; the gap is the
-  silent first *graphical* session for people who never open those.
-
 _(#80–#83 + #85–#88 shipped 2026-07-11. Theme A day-2 + neon-glass finish
   shipped — VISION ✓. Dock/hibernate V3 → HARDWARE-QUEUE. Parallel
   fingerprint-or-password shipped 2026-07-12 (Bernardo promoted it live;
@@ -335,9 +324,9 @@ _(#80–#83 + #85–#88 shipped 2026-07-11. Theme A day-2 + neon-glass finish
 
 ### v1.0 pointer
 
-See **VISION**. Open PROPOSED: post-install hardware hints; NVIDIA
-deferred past v1; IR portal (b)/(c) need T14s (HARDWARE-QUEUE § T14s).
-Standing calls: browser = Chromium; power = PPD.
+See **VISION**. Open PROPOSED: NVIDIA deferred past v1; IR portal (b)/(c)
+need T14s (HARDWARE-QUEUE § T14s). Standing calls: browser = Chromium;
+power = PPD. (Post-install hardware hints shipped 2026-07-17.)
 
 ## Decisions `[human]`
 

agent/JOURNAL.md

@@ -19,6 +19,22 @@ Template:
 
 ---
 
+## 2026-07-17 — Hardware hints: the second (and last) first-session toast
+- **Task:** PROPOSED "Post-install hardware hints" (VISION § B), promoted by
+  Bernardo in-session.
+- **Did:** `nomarchy-first-boot` grew a hints stage after the card:
+  self-gated Firmware/Fingerprint lines (fwupdmgr / fprintd-list on PATH),
+  one toast, marker `settings.hardwareHintsShown`; marker deliberately unset
+  while no tooling matches so late-appearing hardware still gets its hint.
+  README row, HARDWARE.md hint paragraphs, VISION § B checked off.
+  Implementation by a Sonnet agent from my design; review here.
+- **Verified:** V2 — shellcheck clean, flake check green,
+  `checks.first-boot` green (bare-node silent → fwupdmgr appears → fires
+  once → silent → live-ISO skip).
+- **Pending:** real toast rendering is session-surface, same class as the
+  proven #81 card; it will fire once for real on the next fresh session.
+- **Next suggestion:** #127 close-out (upstream filing pending gh auth).
+
 ## 2026-07-17 — #148: dock intent now enforced without the auto-profiles toggle
 - **Task:** BACKLOG #148 (promoted from PROPOSED by Bernardo in-session).
 - **Did:** one-line fix — `enforce_dock_intent` dropped its `auto_on || return`