feat(install): copy templates/downstream and patch install values

Make the downstream template the single source of truth for machine
flakes: nomarchy-install copies flake/system/home/theme-state and
patch-template.py only fills hostname, user, keyboard, detected
hardware, snapper, resume, and password. Install and flake-init users
now share the same commented opt-ins and starter home.packages.

Also: BACKLOG boreal-as-default proposal; installer audit notes;
HARDWARE.md from prior work if uncommitted.

agent/CONVENTIONS.md

@@ -34,7 +34,9 @@ those, it probably shouldn't exist.
   in the downstream template's `home.packages` — opt-out is deleting the
   line.
 - **Opt-in features** ship a commented example in
-  `templates/downstream/home.nix` or `system.nix`.
+  `templates/downstream/home.nix` or `system.nix`. That template is the
+  single source of truth for machine files: `nomarchy-install` copies it
+  and patches install-time values only (never a thinner second catalog).
 - **Menu:** new entries go in the right submenu (Tools › / System ›; root
   stays six entries), end lists with the shared `↩ Back`, self-gate on
   the feature's availability, and add the direct