feat(first-boot): post-install hardware hints — one self-gated toast, once

After the #81 "you're set" card, at most one additional "Hardware tips"
toast: a Firmware line when fwupdmgr is on PATH, a Fingerprint line when
fprintd-list is (VISION § B). One-shot marker settings.hardwareHintsShown,
in-checkout like firstBootShown. When no tooling matches, the marker is
deliberately left unset — the re-check costs a command -v per session,
and a later-enabled fwupd or newly-added reader still gets its hint once.
Never a permanent nag; live-ISO gate covers the new stage too.

Lives inside nomarchy-first-boot: the card's semantics are unchanged
(retry loop, exit 1 so a failed notify retries next login, marker only
after success); hints run only once the card has landed. Docs: README
option row, HARDWARE.md hint paragraphs, VISION § B checked off.

Verification: V2 — shellcheck clean, nix flake check --no-build green,
nix build .#checks.x86_64-linux.first-boot green (bare node silent →
fwupdmgr appears → fires once → silent again → live-ISO still skips).
Real toast rendering is the same session surface as the proven #81 card.
Implementation by a Sonnet subagent; design and review on Fable.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

agent/JOURNAL.md

@@ -19,6 +19,22 @@ Template:
 
 ---
 
+## 2026-07-17 — Hardware hints: the second (and last) first-session toast
+- **Task:** PROPOSED "Post-install hardware hints" (VISION § B), promoted by
+  Bernardo in-session.
+- **Did:** `nomarchy-first-boot` grew a hints stage after the card:
+  self-gated Firmware/Fingerprint lines (fwupdmgr / fprintd-list on PATH),
+  one toast, marker `settings.hardwareHintsShown`; marker deliberately unset
+  while no tooling matches so late-appearing hardware still gets its hint.
+  README row, HARDWARE.md hint paragraphs, VISION § B checked off.
+  Implementation by a Sonnet agent from my design; review here.
+- **Verified:** V2 — shellcheck clean, flake check green,
+  `checks.first-boot` green (bare-node silent → fwupdmgr appears → fires
+  once → silent → live-ISO skip).
+- **Pending:** real toast rendering is session-surface, same class as the
+  proven #81 card; it will fire once for real on the next fresh session.
+- **Next suggestion:** #127 close-out (upstream filing pending gh auth).
+
 ## 2026-07-17 — #148: dock intent now enforced without the auto-profiles toggle
 - **Task:** BACKLOG #148 (promoted from PROPOSED by Bernardo in-session).
 - **Did:** one-line fix — `enforce_dock_intent` dropped its `auto_on || return`