feat(menu): System ▸ Firmware — fwupd/LVFS update surface (#43)

Add a self-gated Firmware row to the System submenu (present whenever
fwupdmgr is on PATH, i.e. services.fwupd.enable — default-on), its
dispatch, and a `firmware` handler that opens a terminal and runs
fwupdmgr refresh → get-updates → y/N confirm → fwupdmgr update. Never
auto-flashes: fwupdmgr update confirms each device and prompts for the
reboot a capsule needs (pillar 1 — no silent BIOS writes). HARDWARE.md
§4 updated to "shipped".

Verified V0 (nix flake check --no-build) + V1 (HM generation builds;
generated nomarchy-menu passes bash -n; firmware handler emitted
correctly). V2 (menu render in a session) queued in #43 and V3 (real
LVFS flash) in HARDWARE-QUEUE — the VM was held by the #46 install test.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agent/BACKLOG.md

@@ -28,15 +28,20 @@ in [`docs/ROADMAP.md`](../docs/ROADMAP.md); map in
 
 ## NEXT
 
-### 43. System › Firmware — fwupd product surface (`VISION § A`)
-`services.fwupd.enable` is already default-on and never auto-flashes,
-but users only learn about `fwupdmgr` from a README sentence. Add a
-self-gated menu entry (System submenu) and/or Control Center row that:
-refreshes metadata, lists updatable devices, confirms, runs
-`fwupdmgr update`, then prints a reboot note when needed. Never
-silent-flash (pillar 1). Optional: first-boot / MOTD one-liner when
-the daemon is active. Spec: docs/HARDWARE.md §4. Cost: menu script +
-optional MOTD; V2 menu, V3 on real LVFS hardware.
+### 43. System › Firmware — fwupd menu (V2 render + optional extensions)
+Core shipped 2026-07-09: self-gated **System ▸ Firmware** rofi row
+(`nomarchy-menu firmware`) — refresh → get-updates → y/N confirm →
+`fwupdmgr update` in a terminal; never silent-flash. Verified V0+V1
+(flake check, HM build, generated `bash -n`). **Remaining:**
+1. **V2** — render the System submenu in a session (VM/live ISO) and
+   confirm the Firmware row shows when fwupd is present and the flow
+   launches. Was blocked on VM contention (a parallel install test held
+   KVM); do it on the next VM pass.
+2. **V3** — real LVFS flash + reboot note on hardware → HARDWARE-QUEUE
+   (entry added).
+3. Optional (own slices): first-boot/MOTD one-liner when fwupd is active;
+   Waybar/updates-panel integration. (The doctor "updates available"
+   check is item #44.) Spec: docs/HARDWARE.md §4.
 
 ### 44. Doctor hardware section — read-only (`VISION § A`)
 Extend `nomarchy-doctor` with the same pass/fail + one-fix-command