feat(menu): System ▸ Firmware — fwupd/LVFS update surface (#43)

Add a self-gated Firmware row to the System submenu (present whenever
fwupdmgr is on PATH, i.e. services.fwupd.enable — default-on), its
dispatch, and a `firmware` handler that opens a terminal and runs
fwupdmgr refresh → get-updates → y/N confirm → fwupdmgr update. Never
auto-flashes: fwupdmgr update confirms each device and prompts for the
reboot a capsule needs (pillar 1 — no silent BIOS writes). HARDWARE.md
§4 updated to "shipped".

Verified V0 (nix flake check --no-build) + V1 (HM generation builds;
generated nomarchy-menu passes bash -n; firmware handler emitted
correctly). V2 (menu render in a session) queued in #43 and V3 (real
LVFS flash) in HARDWARE-QUEUE — the VM was held by the #46 install test.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

agent/JOURNAL.md

@@ -17,6 +17,24 @@ Template:
 
 ---
 
+## 2026-07-09 — #43 System ▸ Firmware fwupd menu (core shipped, V2 pending)
+- **Task:** NEXT #43 — surface fwupd/LVFS updates in the menu (VISION § A).
+  Done while the VM was busy with #46, so V0/V1 only by design.
+- **Did:** Added a self-gated **Firmware** row to the System submenu
+  (`command -v fwupdmgr`, like Printers) + dispatch + a `firmware)` handler
+  that opens a terminal and runs `fwupdmgr refresh` → `get-updates` → y/N
+  confirm → `fwupdmgr update` (never silent-flash; fwupd confirms each
+  device + prompts reboot). Updated docs/HARDWARE.md §4 to "shipped".
+- **Verified:** V0 `nix flake check --no-build` green; V1 HM generation
+  builds; extracted the generated `nomarchy-menu` and confirmed `bash -n`
+  clean + the firmware handler emitted correctly (`exec ghostty -e sh -c`,
+  quoting intact).
+- **Pending:** V2 render (System submenu shows the row + flow launches) —
+  queued in slimmed #43, do on next VM pass (KVM was held by #46). V3 real
+  LVFS flash → HARDWARE-QUEUE. Optional MOTD/Waybar extensions noted.
+- **Next suggestion:** land the #44 doctor-hw agent branch; V2-verify #43+#46
+  together once KVM frees.
+
 ## 2026-07-09 — #45 V2 verify Boreal default + capture preview.png (theme-shot)
 - **Task:** NEXT #45 — close the honesty gap on Boreal-as-default (shipped V0
   only at #42) and capture the picker preview. VM-capable environment (KVM).