feat(first-boot): post-install hardware hints — one self-gated toast, once

After the #81 "you're set" card, at most one additional "Hardware tips"
toast: a Firmware line when fwupdmgr is on PATH, a Fingerprint line when
fprintd-list is (VISION § B). One-shot marker settings.hardwareHintsShown,
in-checkout like firstBootShown. When no tooling matches, the marker is
deliberately left unset — the re-check costs a command -v per session,
and a later-enabled fwupd or newly-added reader still gets its hint once.
Never a permanent nag; live-ISO gate covers the new stage too.

Lives inside nomarchy-first-boot: the card's semantics are unchanged
(retry loop, exit 1 so a failed notify retries next login, marker only
after success); hints run only once the card has landed. Docs: README
option row, HARDWARE.md hint paragraphs, VISION § B checked off.

Verification: V2 — shellcheck clean, nix flake check --no-build green,
nix build .#checks.x86_64-linux.first-boot green (bare node silent →
fwupdmgr appears → fires once → silent again → live-ISO still skips).
Real toast rendering is the same session surface as the proven #81 card.
Implementation by a Sonnet subagent; design and review on Fable.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/VISION.md

@@ -74,7 +74,7 @@ Reference: [HARDWARE.md](HARDWARE.md) §4–§5, §11 (doctor).
 | **Silent first-week card** ✓ | One dismissible “you’re set” (menu, themes, keys, network) — not a wizard | ✓ shipped #81 — `settings.firstBootShown` + notify; live ISO keeps its own toast |
 | **Boreal as default** ✓ | Identity on first boot | ✓ seed `state.json` + install path use Boreal (2026-07-09) |
 | **Generation readability** ✓ | “What changed last rebuild” in plain language | ✓ shipped #82 — nvd toast + System › What changed? |
-| **Post-install hints** | One-shot MOTD/notify for fwupd / fprintd when relevant | Partial: MOTD tips; first-session toast is #81; still refine self-gated hardware hints if needed |
+| **Post-install hints** ✓ | One-shot MOTD/notify for fwupd / fprintd when relevant | ✓ shipped 2026-07-17 — self-gated “Hardware tips” toast after the #81 card (`settings.hardwareHintsShown`), fwupd/fprintd lines when the tooling is on PATH |
 
 ---
 
@@ -154,13 +154,11 @@ From GOALS non-goals and installer audits — do not “fill the roadmap” with
 
 **Still open** (as of 2026-07-11). Shipped items above are *not* open work.
 
-1. `VISION § B` — post-install hardware hints (self-gated first-session
-   toast when `fwupdmgr` / `fprintd-list` exist; one-shot markers; no nag)
-2. `VISION § D` / LATER — wallpapers artifact split (decided deferred;
+1. `VISION § D` / LATER — wallpapers artifact split (decided deferred;
    promote only if theme-switch latency still hurts after measurement)
-3. `VISION § H` — HARDWARE-QUEUE burn-down (human-only V3; agents only
+2. `VISION § H` — HARDWARE-QUEUE burn-down (human-only V3; agents only
    append exact steps)
-4. `VISION § v1.0` — install P0 re-verify before any `v1` fast-forward
+3. `VISION § v1.0` — install P0 re-verify before any `v1` fast-forward
    (swap=0 / unattended LUKS contracts; human ships the pointer)
 
 Do **not** re-open Theme A firmware/fingerprint/doctor/rebuild rows —