fix: real-hardware QA sweep — wifi, fonts, firmware, Hyprland 0.55, offline switching

Roadmap items 1+2 plus the issues found testing on a Latitude 5410:

- Ship the 10 most popular Nerd Fonts by default (iosevka swapped for
  mononoki: 1.1 GB vs 27 MB) and warn from nomarchy-theme-sync when a
  configured fonts.mono/fonts.ui family isn't installed (fc-match) —
  fontconfig substitutes silently otherwise.
- hardware.enableRedistributableFirmware: installed systems shipped NO
  firmware blobs (wifi/SOF audio/BT) — nixos-generate-config only emits
  microcode lines referencing this flag, it never sets it.
- Live ISO wifi: networking.wireless.enable = mkForce false killed
  NetworkManager's supplicant — since 26.05 the NM module drives its
  wifi backend THROUGH networking.wireless (dbusControlled). Devices
  vanished from nmtui with iwlwifi loaded and no rfkill block.
- Hyprland 0.55: launch sessions via start-hyprland (watchdog; bare
  binary warns), add the new gesture keyword (workspace_swipe is gone —
  touchpads had no gestures at all), media keys via wpctl/bindel/bindl
  plus the missing mic/play/next/prev binds.
- Offline theme switching: pin mustache-go + stdenv + the repo's own
  standalone HM generation (incl. home-files inputDerivation) into the
  ISO — stylix re-renders base16 templates per switch and an offline
  `apply` cascaded into building stdenv from source (1107 drvs).
  Verified with tools/vm/gap-analysis.py: 17 config drvs, zero fetches.
- Stylix: track release-26.05 (kills the HM version-skew warning and
  the stale home-manager follows), lock updated.
- Roadmap: swaync (no notification daemon ships today).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

flake.nix

@@ -10,9 +10,12 @@
     };
 
     stylix = {
-      url = "github:danth/stylix";
+      # Track the release branch matching nixpkgs/HM — master is built
+      # against unstable and warns about the version skew on every
+      # activation. (No home-manager input to follow anymore: stylix
+      # vendors its HM integration.)
+      url = "github:nix-community/stylix/release-26.05";
       inputs.nixpkgs.follows = "nixpkgs";
-      inputs.home-manager.follows = "home-manager";
     };
 
     # Pinned by Nomarchy so distro + hardware quirks are tested together
@@ -270,6 +273,20 @@
                   representativeInstall.config.system.build.toplevel
                   template.homeConfigurations.${username}.activationPackage
 
+                  # The live session's `home-manager switch` builds the
+                  # REPO's standalone generation (the seeded ~/.nomarchy
+                  # flake) — not the template's, and not the NixOS-module
+                  # one baked into the ISO. It has drvs the other two
+                  # variants don't (user-dbus-services et al.), so pin it
+                  # and its direct build inputs too.
+                  self.homeConfigurations.${username}.activationPackage
+                  self.homeConfigurations.${username}.activationPackage.inputDerivation
+                  # home-files is rebuilt per theme and COPIES some of its
+                  # inputs (user-dbus-services) instead of referencing
+                  # them — the activation closure doesn't carry those, so
+                  # pin home-files' direct build inputs separately.
+                  self.homeConfigurations.${username}.config.home-files.inputDerivation
+
                   # A real install rebuilds the drvs that embed the
                   # user's hostname/username/UUIDs (etc, initrd, units,
                   # toplevel, HM activation). inputDerivation pins each
@@ -278,6 +295,15 @@
                   representativeInstall.config.system.build.etc.inputDerivation
                   representativeInstall.config.system.build.initialRamdisk.inputDerivation
                   template.homeConfigurations.${username}.activationPackage.inputDerivation
+                ] ++ [
+                  # A theme switch re-renders stylix's base16 templates
+                  # (gtk.css, kvantum, …) on the machine: the renderer and
+                  # the stdenv its trivial drvs build with must be on
+                  # board, or an offline `apply <theme>` cascades into
+                  # building mustache-go (and eventually stdenv) from
+                  # source. Found with tools/vm/gap-analysis.py.
+                  pkgs.mustache-go
+                  pkgs.stdenv
                 ] ++ [
                   # …and the second-level build tools those rebuilds need
                   # (their parents are themselves rebuilt, so parent