feat(menu): System ▸ Firmware — fwupd/LVFS update surface (#43)

Add a self-gated Firmware row to the System submenu (present whenever
fwupdmgr is on PATH, i.e. services.fwupd.enable — default-on), its
dispatch, and a `firmware` handler that opens a terminal and runs
fwupdmgr refresh → get-updates → y/N confirm → fwupdmgr update. Never
auto-flashes: fwupdmgr update confirms each device and prompts for the
reboot a capsule needs (pillar 1 — no silent BIOS writes). HARDWARE.md
§4 updated to "shipped".

Verified V0 (nix flake check --no-build) + V1 (HM generation builds;
generated nomarchy-menu passes bash -n; firmware handler emitted
correctly). V2 (menu render in a session) queued in #43 and V3 (real
LVFS flash) in HARDWARE-QUEUE — the VM was held by the #46 install test.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/HARDWARE.md

@@ -120,16 +120,20 @@ Disable on VMs/headless: `services.fwupd.enable = false;` in `system.nix`.
 
 | Present | Missing |
 |---------|---------|
-| Daemon + package | Menu entry / Control Center |
-| README one-liner | First-boot / MOTD hint |
-| | Doctor check (“updates available”) |
-| | Waybar / updates panel integration |
+| Daemon + package | First-boot / MOTD hint |
+| README one-liner | Doctor check (“updates available”) |
+| **System ▸ Firmware menu** (`nomarchy-menu firmware`) | Waybar / updates panel integration |
 
-**Product direction (queued):** System › Firmware (or a Doctor section)
-that runs refresh → list → confirm → `fwupdmgr update`, plus a short
-post-install note when `fwupd` is enabled. Never auto-flash; pillar 1
+**System ▸ Firmware** (shipped): a self-gated System-submenu row (present
+whenever `fwupdmgr` is on PATH, i.e. `services.fwupd.enable`, default-on)
+that opens a terminal and runs `fwupdmgr refresh` → `get-updates` →
+confirm → `fwupdmgr update`. It never auto-flashes — `fwupdmgr update`
+confirms each device and prompts for the reboot a capsule needs; pillar 1
 (rock-stable) forbids silent BIOS writes.
 
+**Still queued:** a post-install / MOTD one-liner when `fwupd` is active,
+a Doctor “updates available” check, and Waybar/updates-panel integration.
+
 ### Thunderbolt
 
 Firmware for TB devices may appear via LVFS. There is **no** first-class