fix: real-hardware QA sweep — wifi, fonts, firmware, Hyprland 0.55, offline switching

Roadmap items 1+2 plus the issues found testing on a Latitude 5410:

- Ship the 10 most popular Nerd Fonts by default (iosevka swapped for
  mononoki: 1.1 GB vs 27 MB) and warn from nomarchy-theme-sync when a
  configured fonts.mono/fonts.ui family isn't installed (fc-match) —
  fontconfig substitutes silently otherwise.
- hardware.enableRedistributableFirmware: installed systems shipped NO
  firmware blobs (wifi/SOF audio/BT) — nixos-generate-config only emits
  microcode lines referencing this flag, it never sets it.
- Live ISO wifi: networking.wireless.enable = mkForce false killed
  NetworkManager's supplicant — since 26.05 the NM module drives its
  wifi backend THROUGH networking.wireless (dbusControlled). Devices
  vanished from nmtui with iwlwifi loaded and no rfkill block.
- Hyprland 0.55: launch sessions via start-hyprland (watchdog; bare
  binary warns), add the new gesture keyword (workspace_swipe is gone —
  touchpads had no gestures at all), media keys via wpctl/bindel/bindl
  plus the missing mic/play/next/prev binds.
- Offline theme switching: pin mustache-go + stdenv + the repo's own
  standalone HM generation (incl. home-files inputDerivation) into the
  ISO — stylix re-renders base16 templates per switch and an offline
  `apply` cascaded into building stdenv from source (1107 drvs).
  Verified with tools/vm/gap-analysis.py: 17 config drvs, zero fetches.
- Stylix: track release-26.05 (kills the HM version-skew warning and
  the stale home-manager follows), lock updated.
- Roadmap: swaync (no notification daemon ships today).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

hosts/live.nix

@@ -9,9 +9,11 @@
   isoImage.volumeID = lib.mkForce "NOMARCHY_LIVE";
   isoImage.edition = lib.mkForce "live";
 
-  # The minimal-CD profile enables wpa_supplicant; Nomarchy ships
-  # NetworkManager and the two must not run together.
-  networking.wireless.enable = lib.mkForce false;
+  # Do NOT touch networking.wireless here: since NixOS 26.05 the
+  # NetworkManager module drives its wifi backend through it
+  # (wireless.enable = true + dbusControlled). Force-disabling it
+  # kills NM's supplicant — wifi devices vanish from nmtui even
+  # though the driver is loaded (seen on a Latitude 5410 / AX201).
 
   # ── Live user: no password, straight into the desktop ──────────────
   users.users.${username} = {
@@ -24,7 +26,7 @@
 
   # Boot straight into Hyprland once; logging out lands on tuigreet.
   services.greetd.settings.initial_session = {
-    command = "Hyprland";
+    command = "start-hyprland";
     user = username;
   };