feat(install): copy templates/downstream and patch install values

Make the downstream template the single source of truth for machine
flakes: nomarchy-install copies flake/system/home/theme-state and
patch-template.py only fills hostname, user, keyboard, detected
hardware, snapper, resume, and password. Install and flake-init users
now share the same commented opt-ins and starter home.packages.

Also: BACKLOG boreal-as-default proposal; installer audit notes;
HARDWARE.md from prior work if uncommitted.

templates/downstream/system.nix

@@ -2,6 +2,9 @@
 # The distro itself comes from nomarchy.nixosModules.nomarchy — override
 # any of its defaults here with plain NixOS options (they use mkDefault),
 # or via the nomarchy.system.* toggles.
+#
+# Source of truth for install and flake-init: nomarchy-install copies this
+# file and only patches placeholders + the __NOMARCHY_INSTALLER__ region.
 { pkgs, username, ... }:
 
 {
@@ -12,12 +15,28 @@
   time.timeZone = "UTC";
   i18n.defaultLocale = "en_US.UTF-8";
 
+  # One keyboard layout everywhere: xkb is the source of truth; the distro
+  # defaults (console.useXkbConfig + systemd initrd) derive the virtual
+  # console and the LUKS passphrase prompt from it. Match home.nix
+  # nomarchy.keyboard.*.
+  services.xserver.xkb.layout = "us";
+  services.xserver.xkb.variant = "";
+
   # Your login user — `username` flows in from flake.nix automatically.
+  # The installer adds initialHashedPassword here; flake-init: set a password
+  # (or users.mutableUsers) before first boot if needed.
   users.users.${username} = {
     isNormalUser = true;
     extraGroups = [ "wheel" "networkmanager" "video" "input" ];
   };
 
+  # __NOMARCHY_INSTALLER_BEGIN__
+  # Installer fills this region (power, hardware, snapper, resume, autoLogin).
+  # Flake-init: leave empty and use the commented catalog below, or enable
+  # snapper when on BTRFS with a /.snapshots subvolume:
+  # nomarchy.system.snapper.enable = true;
+  # __NOMARCHY_INSTALLER_END__
+
   # ── Overrides (uncomment to change) ─────────────────────────────────
   # nomarchy.system.greeter.enable = false;   # bring your own login manager
   # environment.systemPackages = [ pkgs.htop ];
@@ -48,6 +67,8 @@
   #   latestKernel = true;                       #   newest kernel for very-new hardware (drivers not yet in the default)
   #   camera.hideIrSensor = true;               #   dual-sensor webcam: hide the IR node so apps get the color cam
   #                                             #   (installer-set when a paired RGB+IR webcam is detected)
+  #   i2c.enable = true;                        #   /dev/i2c-* (RGB, sensors); ddcci is distro-default for external brightness
+  #   i2c.ddcci = true;                         #   already mkDefault true — set false to opt out
   # };
   #
   # nomarchy.services.tailscale.enable = true; # mesh VPN — connect from System › VPN