feat(nixos): prune system+HM gens after 14d, keep ≥3 past (#128)

Weekly nomarchy-gen-prune deletes only generations that are both older
than 14 days and beyond the three most recent past gens (current always
kept), for system and Home Manager profiles. Stock nix.gc no longer uses
--delete-older-than. checks.gen-prune covers selection self-test and
unit wiring; doctor points at the new tool when disk is tight.

flake.nix

@@ -90,6 +90,7 @@
         nomarchy-what-changed = final.callPackage ./pkgs/nomarchy-what-changed { };
         nomarchy-detect-hw = final.callPackage ./pkgs/nomarchy-detect-hw { };
         nomarchy-airplane = final.callPackage ./pkgs/nomarchy-airplane { };
+        nomarchy-gen-prune = final.callPackage ./pkgs/nomarchy-gen-prune { };
         # pull / rebuild / home (+ legacy aliases) — also on HM so a home
         # switch can refresh a broken system-package nomarchy-pull.
         # Includes nomarchy-what-changed (generation readability, #82).
@@ -604,6 +605,36 @@
                 touch $out
               '';
 
+          # Generation prune (#128): pure selection self-test (14d + keep ≥3
+          # past) baked into the script; assert timer+service on the distro.
+          gen-prune =
+            let
+              node = self.nixosConfigurations.nomarchy;
+              timerWanted =
+                builtins.elem "timers.target"
+                  (node.config.systemd.timers.nomarchy-gen-prune.wantedBy or [ ]);
+              execStart =
+                node.config.systemd.services.nomarchy-gen-prune.serviceConfig.ExecStart or "";
+              gcOpts = node.config.nix.gc.options or "";
+              noAgeWipe =
+                gcOpts == ""
+                || !(nixpkgs.lib.hasInfix "delete-older-than" gcOpts);
+            in
+            assert nixpkgs.lib.assertMsg timerWanted
+              "gen-prune: timer not wanted by timers.target";
+            assert nixpkgs.lib.assertMsg (execStart != "")
+              "gen-prune: service ExecStart empty";
+            assert nixpkgs.lib.assertMsg noAgeWipe
+              "gen-prune: nix.gc.options must not use --delete-older-than (got: ${gcOpts})";
+            pkgs.runCommand "nomarchy-gen-prune"
+              { nativeBuildInputs = [ pkgs.bash ]; }
+              ''
+                set -eu
+                ${pkgs.nomarchy-gen-prune}/bin/nomarchy-gen-prune --self-test
+                ${pkgs.nomarchy-gen-prune}/bin/nomarchy-gen-prune --dry-run >/dev/null
+                touch $out
+              '';
+
           # Installer keyboard no-variant regression (item 91): gum's `(none)`
           # row is display-only.  Exercise it through the real template
           # patcher, then build the exact us + empty-variant console keymap