feat: allow unfree packages distro-wide

nixpkgs.config.allowUnfree in the system module (covers the live ISO
via useGlobalPkgs and every mkFlake machine) plus the two explicit
`import nixpkgs` sites (repo + lib.nix) so the standalone HM desktop
sees the same package set. Unblocks claude-code for the menu system's
ask-Claude module, vendor drivers, etc. Opt out with
`nixpkgs.config = lib.mkForce { allowUnfree = false; }`.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

flake.nix

@@ -35,6 +35,9 @@
       pkgs = import nixpkgs {
         inherit system;
         overlays = [ self.overlays.default ];
+        # Matches nixpkgs.config.allowUnfree in modules/nixos — the
+        # standalone HM generation must come from like-configured pkgs.
+        config.allowUnfree = true;
       };
 
       # The guided installer — live-ISO only (not in the overlay): it bakes