feat(menu): System ▸ Firmware — fwupd/LVFS update surface (#43)

Add a self-gated Firmware row to the System submenu (present whenever
fwupdmgr is on PATH, i.e. services.fwupd.enable — default-on), its
dispatch, and a `firmware` handler that opens a terminal and runs
fwupdmgr refresh → get-updates → y/N confirm → fwupdmgr update. Never
auto-flashes: fwupdmgr update confirms each device and prompts for the
reboot a capsule needs (pillar 1 — no silent BIOS writes). HARDWARE.md
§4 updated to "shipped".

Verified V0 (nix flake check --no-build) + V1 (HM generation builds;
generated nomarchy-menu passes bash -n; firmware handler emitted
correctly). V2 (menu render in a session) queued in #43 and V3 (real
LVFS flash) in HARDWARE-QUEUE — the VM was held by the #46 install test.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agent/HARDWARE-QUEUE.md

@@ -324,6 +324,14 @@ QA machine), the **T14s** (webcam case).
       active and PPD switching governors; opt-ins: ROCm (`rocminfo`, a GPU
       PyTorch/Ollama smoke) and the XDNA NPU driver loading.
 - [ ] **Fingerprint** — `fprintd-enroll` + (opt-in PAM) login/sudo.
+- [ ] **System ▸ Firmware menu on real LVFS hardware** (item #43,
+      `nomarchy-menu firmware`) — on a machine whose firmware/SSD/dock is
+      on LVFS: open Menu ▸ System ▸ **Firmware**; confirm the terminal runs
+      `fwupdmgr refresh` → lists real `get-updates` → the y/N confirm gates
+      correctly → `fwupdmgr update` applies and prints the reboot note when a
+      capsule needs one. Verify **no** flash happens on "N"/cancel. (VM only
+      proves the menu row + flow renders; a real capsule write is
+      hardware-only.)
 
 ## Latitude 5410 only
 - [x] **Waybar theme-switch resilience** (finding #1 re-test, needs main ≥