feat(first-boot): post-install hardware hints — one self-gated toast, once

After the #81 "you're set" card, at most one additional "Hardware tips"
toast: a Firmware line when fwupdmgr is on PATH, a Fingerprint line when
fprintd-list is (VISION § B). One-shot marker settings.hardwareHintsShown,
in-checkout like firstBootShown. When no tooling matches, the marker is
deliberately left unset — the re-check costs a command -v per session,
and a later-enabled fwupd or newly-added reader still gets its hint once.
Never a permanent nag; live-ISO gate covers the new stage too.

Lives inside nomarchy-first-boot: the card's semantics are unchanged
(retry loop, exit 1 so a failed notify retries next login, marker only
after success); hints run only once the card has landed. Docs: README
option row, HARDWARE.md hint paragraphs, VISION § B checked off.

Verification: V2 — shellcheck clean, nix flake check --no-build green,
nix build .#checks.x86_64-linux.first-boot green (bare node silent →
fwupdmgr appears → fires once → silent again → live-ISO still skips).
Real toast rendering is the same session surface as the proven #81 card.
Implementation by a Sonnet subagent; design and review on Fable.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/HARDWARE.md

@@ -138,7 +138,10 @@ confirms each device and prompts for the reboot a capsule needs; pillar 1
 
 **Hints (#43 / #73):** MOTD cheat-sheet line when `fwupdmgr` is on PATH.
 Fingerprint / doctor tips follow the same pattern (fingerprint MOTD only
-when `nomarchy.hardware.fingerprint.enable`).
+when `nomarchy.hardware.fingerprint.enable`). A one-shot toast in the
+first graphical session also points at System › Firmware when `fwupdmgr`
+is on PATH (`settings.hardwareHintsShown`, `nomarchy-first-boot`) — for
+people who never read the MOTD.
 
 **Still queued:** a Doctor “updates available” check, and
 Waybar/updates-panel integration.
@@ -191,7 +194,10 @@ happen — sudo, the lock screen, and the greeter only when
 
 **Hints (#73):** MOTD line when `fingerprint.enable` is on; first-boot
 tip when `fprintd-list` is on PATH (`SUPER+M → System › Fingerprint` /
-`fprintd-enroll`). No permanent nag without a reader.
+`fprintd-enroll`). No permanent nag without a reader. A one-shot toast in
+the first graphical session also points at System › Fingerprint when
+`fprintd-list` is on PATH (`settings.hardwareHintsShown`,
+`nomarchy-first-boot`) — for people who never read the MOTD.
 
 ```sh
 # CLI still works: