feat(install): copy templates/downstream and patch install values

Make the downstream template the single source of truth for machine
flakes: nomarchy-install copies flake/system/home/theme-state and
patch-template.py only fills hostname, user, keyboard, detected
hardware, snapper, resume, and password. Install and flake-init users
now share the same commented opt-ins and starter home.packages.

Also: BACKLOG boreal-as-default proposal; installer audit notes;
HARDWARE.md from prior work if uncommitted.

templates/downstream/README.md

@@ -1,5 +1,11 @@
 # My Nomarchy machine
 
+This directory is the **single source of truth** for a Nomarchy machine
+flake. `nix flake init -t …` copies it as-is; **`nomarchy-install` copies
+the same files and only patches** install-time values (username, hostname,
+keyboard, detected hardware, password hash, …). Keep commented opt-ins and
+`home.packages` here — do not invent a second catalog in the installer.
+
 1. Overwrite the placeholder hardware config with the real one:
    `nixos-generate-config --show-hardware-config > hardware-configuration.nix`
 2. Set `flake.nix` up **once** (Nomarchy repo URL, your username, optionally