feat(install): copy templates/downstream and patch install values

Make the downstream template the single source of truth for machine
flakes: nomarchy-install copies flake/system/home/theme-state and
patch-template.py only fills hostname, user, keyboard, detected
hardware, snapper, resume, and password. Install and flake-init users
now share the same commented opt-ins and starter home.packages.

Also: BACKLOG boreal-as-default proposal; installer audit notes;
HARDWARE.md from prior work if uncommitted.

templates/downstream/README.md

@@ -1,5 +1,11 @@
 # My Nomarchy machine
 
+This directory is the **single source of truth** for a Nomarchy machine
+flake. `nix flake init -t …` copies it as-is; **`nomarchy-install` copies
+the same files and only patches** install-time values (username, hostname,
+keyboard, detected hardware, password hash, …). Keep commented opt-ins and
+`home.packages` here — do not invent a second catalog in the installer.
+
 1. Overwrite the placeholder hardware config with the real one:
    `nixos-generate-config --show-hardware-config > hardware-configuration.nix`
 2. Set `flake.nix` up **once** (Nomarchy repo URL, your username, optionally

templates/downstream/flake.nix

@@ -5,6 +5,7 @@
   # tested together upstream. This file is written once (by you or the
   # installer) and never hand-edited afterwards; your machine lives in
   # system.nix and home.nix. v1 is the release branch.
+  # Installer copies this template and patches username + hardwareProfile.
   inputs.nomarchy.url = "git+https://git.bemagri.xyz/bernardo/nomarchy.git?ref=v1";
 
   outputs = { nomarchy, ... }:

templates/downstream/home.nix

@@ -2,17 +2,21 @@
 # Ghostty, theming engine, Stylix) comes from homeModules.nomarchy;
 # tune it via the nomarchy.* options, add your own packages and
 # programs below.
+#
+# Source of truth for install and flake-init: nomarchy-install copies this
+# file and only patches keyboard layout/variant.
 { pkgs, ... }:
 
 {
+  # Session keyboard — match services.xserver.xkb.* in system.nix (console
+  # + LUKS prompt follow xkb via the distro module). Installer patches these.
+  nomarchy.keyboard.layout = "us";
+  nomarchy.keyboard.variant = "";
+
   # ── Overrides (the desktop is on by default; tweak or opt out) ──────
   # nomarchy.terminal = "kitty";        # swap the default terminal
   # nomarchy.waybar.enable = false;     # bring your own bar
   # nomarchy.stylix.enable = false;     # opt out of GTK/Qt theming
-  # nomarchy.keyboard.layout = "de";    # session keyboard (set the matching
-  #                                     # services.xserver.xkb.layout in
-  #                                     # system.nix too; the console + LUKS
-  #                                     # prompt follow it automatically)
 
   # ── Opt-in features — uncomment and tweak to enable ─────────────────
   # nomarchy.nightlight = {             # scheduled blue-light filter (hyprsunset)

templates/downstream/system.nix

@@ -2,6 +2,9 @@
 # The distro itself comes from nomarchy.nixosModules.nomarchy — override
 # any of its defaults here with plain NixOS options (they use mkDefault),
 # or via the nomarchy.system.* toggles.
+#
+# Source of truth for install and flake-init: nomarchy-install copies this
+# file and only patches placeholders + the __NOMARCHY_INSTALLER__ region.
 { pkgs, username, ... }:
 
 {
@@ -12,12 +15,28 @@
   time.timeZone = "UTC";
   i18n.defaultLocale = "en_US.UTF-8";
 
+  # One keyboard layout everywhere: xkb is the source of truth; the distro
+  # defaults (console.useXkbConfig + systemd initrd) derive the virtual
+  # console and the LUKS passphrase prompt from it. Match home.nix
+  # nomarchy.keyboard.*.
+  services.xserver.xkb.layout = "us";
+  services.xserver.xkb.variant = "";
+
   # Your login user — `username` flows in from flake.nix automatically.
+  # The installer adds initialHashedPassword here; flake-init: set a password
+  # (or users.mutableUsers) before first boot if needed.
   users.users.${username} = {
     isNormalUser = true;
     extraGroups = [ "wheel" "networkmanager" "video" "input" ];
   };
 
+  # __NOMARCHY_INSTALLER_BEGIN__
+  # Installer fills this region (power, hardware, snapper, resume, autoLogin).
+  # Flake-init: leave empty and use the commented catalog below, or enable
+  # snapper when on BTRFS with a /.snapshots subvolume:
+  # nomarchy.system.snapper.enable = true;
+  # __NOMARCHY_INSTALLER_END__
+
   # ── Overrides (uncomment to change) ─────────────────────────────────
   # nomarchy.system.greeter.enable = false;   # bring your own login manager
   # environment.systemPackages = [ pkgs.htop ];
@@ -48,6 +67,8 @@
   #   latestKernel = true;                       #   newest kernel for very-new hardware (drivers not yet in the default)
   #   camera.hideIrSensor = true;               #   dual-sensor webcam: hide the IR node so apps get the color cam
   #                                             #   (installer-set when a paired RGB+IR webcam is detected)
+  #   i2c.enable = true;                        #   /dev/i2c-* (RGB, sensors); ddcci is distro-default for external brightness
+  #   i2c.ddcci = true;                         #   already mkDefault true — set false to opt out
   # };
   #
   # nomarchy.services.tailscale.enable = true; # mesh VPN — connect from System › VPN