feat(first-boot): post-install hardware hints — one self-gated toast, once

After the #81 "you're set" card, at most one additional "Hardware tips"
toast: a Firmware line when fwupdmgr is on PATH, a Fingerprint line when
fprintd-list is (VISION § B). One-shot marker settings.hardwareHintsShown,
in-checkout like firstBootShown. When no tooling matches, the marker is
deliberately left unset — the re-check costs a command -v per session,
and a later-enabled fwupd or newly-added reader still gets its hint once.
Never a permanent nag; live-ISO gate covers the new stage too.

Lives inside nomarchy-first-boot: the card's semantics are unchanged
(retry loop, exit 1 so a failed notify retries next login, marker only
after success); hints run only once the card has landed. Docs: README
option row, HARDWARE.md hint paragraphs, VISION § B checked off.

Verification: V2 — shellcheck clean, nix flake check --no-build green,
nix build .#checks.x86_64-linux.first-boot green (bare node silent →
fwupdmgr appears → fires once → silent again → live-ISO still skips).
Real toast rendering is the same session surface as the proven #81 card.
Implementation by a Sonnet subagent; design and review on Fable.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/HARDWARE.md

@@ -138,7 +138,10 @@ confirms each device and prompts for the reboot a capsule needs; pillar 1
 
 **Hints (#43 / #73):** MOTD cheat-sheet line when `fwupdmgr` is on PATH.
 Fingerprint / doctor tips follow the same pattern (fingerprint MOTD only
-when `nomarchy.hardware.fingerprint.enable`).
+when `nomarchy.hardware.fingerprint.enable`). A one-shot toast in the
+first graphical session also points at System › Firmware when `fwupdmgr`
+is on PATH (`settings.hardwareHintsShown`, `nomarchy-first-boot`) — for
+people who never read the MOTD.
 
 **Still queued:** a Doctor “updates available” check, and
 Waybar/updates-panel integration.
@@ -191,7 +194,10 @@ happen — sudo, the lock screen, and the greeter only when
 
 **Hints (#73):** MOTD line when `fingerprint.enable` is on; first-boot
 tip when `fprintd-list` is on PATH (`SUPER+M → System › Fingerprint` /
-`fprintd-enroll`). No permanent nag without a reader.
+`fprintd-enroll`). No permanent nag without a reader. A one-shot toast in
+the first graphical session also points at System › Fingerprint when
+`fprintd-list` is on PATH (`settings.hardwareHintsShown`,
+`nomarchy-first-boot`) — for people who never read the MOTD.
 
 ```sh
 # CLI still works:

docs/ROADMAP.md

@@ -493,6 +493,17 @@ Design/decision records and a running log of shipped work (items marked
   V2 by render, both heads + the password dialog, via the new
   `tools/plymouth-preview.sh`. V3 (a real docked boot/shutdown) is queued: the
   fake heads exist from the start, so the rig cannot resize a canvas.
+- ✓ **Post-install hardware hints (VISION § B, 2026-07-17):** after the #81
+  "you're set" card, at most one additional "Hardware tips" toast — a
+  Firmware line when `fwupdmgr` is on PATH, a Fingerprint line when
+  `fprintd-list` is — with its own one-shot marker
+  (`settings.hardwareHintsShown`, in-checkout like `firstBootShown`). If no
+  tooling matches, the marker is deliberately left unset so the hint still
+  fires once if fwupd/a reader appears later. Lives inside
+  `nomarchy-first-boot` (the card's exit-1-retries-next-login semantics are
+  preserved; hints only run once the card has landed). V2:
+  `checks.first-boot` grew the silent-bare-node → fwupdmgr-appears →
+  fires-once → silent-again → live-ISO-still-skips flow.
 - ✓ **Reload re-lit the panel inside a shut lid (#148, 2026-07-17):** every
   `nomarchy-home` (HM activation → `hyprctl reload`) re-applied the catch-all
   monitor rule and left eDP-1 burning in the closed clamshell. The #142 tick

docs/VISION.md

@@ -74,7 +74,7 @@ Reference: [HARDWARE.md](HARDWARE.md) §4–§5, §11 (doctor).
 | **Silent first-week card** ✓ | One dismissible “you’re set” (menu, themes, keys, network) — not a wizard | ✓ shipped #81 — `settings.firstBootShown` + notify; live ISO keeps its own toast |
 | **Boreal as default** ✓ | Identity on first boot | ✓ seed `state.json` + install path use Boreal (2026-07-09) |
 | **Generation readability** ✓ | “What changed last rebuild” in plain language | ✓ shipped #82 — nvd toast + System › What changed? |
-| **Post-install hints** | One-shot MOTD/notify for fwupd / fprintd when relevant | Partial: MOTD tips; first-session toast is #81; still refine self-gated hardware hints if needed |
+| **Post-install hints** ✓ | One-shot MOTD/notify for fwupd / fprintd when relevant | ✓ shipped 2026-07-17 — self-gated “Hardware tips” toast after the #81 card (`settings.hardwareHintsShown`), fwupd/fprintd lines when the tooling is on PATH |
 
 ---
 
@@ -154,13 +154,11 @@ From GOALS non-goals and installer audits — do not “fill the roadmap” with
 
 **Still open** (as of 2026-07-11). Shipped items above are *not* open work.
 
-1. `VISION § B` — post-install hardware hints (self-gated first-session
-   toast when `fwupdmgr` / `fprintd-list` exist; one-shot markers; no nag)
-2. `VISION § D` / LATER — wallpapers artifact split (decided deferred;
+1. `VISION § D` / LATER — wallpapers artifact split (decided deferred;
    promote only if theme-switch latency still hurts after measurement)
-3. `VISION § H` — HARDWARE-QUEUE burn-down (human-only V3; agents only
+2. `VISION § H` — HARDWARE-QUEUE burn-down (human-only V3; agents only
    append exact steps)
-4. `VISION § v1.0` — install P0 re-verify before any `v1` fast-forward
+3. `VISION § v1.0` — install P0 re-verify before any `v1` fast-forward
    (swap=0 / unattended LUKS contracts; human ships the pointer)
 
 Do **not** re-open Theme A firmware/fingerprint/doctor/rebuild rows —