feat(first-boot): post-install hardware hints — one self-gated toast, once

After the #81 "you're set" card, at most one additional "Hardware tips"
toast: a Firmware line when fwupdmgr is on PATH, a Fingerprint line when
fprintd-list is (VISION § B). One-shot marker settings.hardwareHintsShown,
in-checkout like firstBootShown. When no tooling matches, the marker is
deliberately left unset — the re-check costs a command -v per session,
and a later-enabled fwupd or newly-added reader still gets its hint once.
Never a permanent nag; live-ISO gate covers the new stage too.

Lives inside nomarchy-first-boot: the card's semantics are unchanged
(retry loop, exit 1 so a failed notify retries next login, marker only
after success); hints run only once the card has landed. Docs: README
option row, HARDWARE.md hint paragraphs, VISION § B checked off.

Verification: V2 — shellcheck clean, nix flake check --no-build green,
nix build .#checks.x86_64-linux.first-boot green (bare node silent →
fwupdmgr appears → fires once → silent again → live-ISO still skips).
Real toast rendering is the same session surface as the proven #81 card.
Implementation by a Sonnet subagent; design and review on Fable.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/ROADMAP.md

@@ -493,6 +493,17 @@ Design/decision records and a running log of shipped work (items marked
   V2 by render, both heads + the password dialog, via the new
   `tools/plymouth-preview.sh`. V3 (a real docked boot/shutdown) is queued: the
   fake heads exist from the start, so the rig cannot resize a canvas.
+- ✓ **Post-install hardware hints (VISION § B, 2026-07-17):** after the #81
+  "you're set" card, at most one additional "Hardware tips" toast — a
+  Firmware line when `fwupdmgr` is on PATH, a Fingerprint line when
+  `fprintd-list` is — with its own one-shot marker
+  (`settings.hardwareHintsShown`, in-checkout like `firstBootShown`). If no
+  tooling matches, the marker is deliberately left unset so the hint still
+  fires once if fwupd/a reader appears later. Lives inside
+  `nomarchy-first-boot` (the card's exit-1-retries-next-login semantics are
+  preserved; hints only run once the card has landed). V2:
+  `checks.first-boot` grew the silent-bare-node → fwupdmgr-appears →
+  fires-once → silent-again → live-ISO-still-skips flow.
 - ✓ **Reload re-lit the panel inside a shut lid (#148, 2026-07-17):** every
   `nomarchy-home` (HM activation → `hyprctl reload`) re-applied the catch-all
   monitor rule and left eDP-1 burning in the closed clamshell. The #142 tick