feat(system): Plymouth splash, distroName, allowUnfree, offline-pin hardening

- Plymouth boot splash ported from the legacy branch (modules/nixos/
  plymouth/): logo + eased progress + LUKS entry, background tinted from
  theme-state.json via the new nomarchy.system.stateFile (wired by
  mkFlake/lib.nix; null → Tokyo Night fallback). Default on; OFF on the
  live ISO (boot-message visibility on the install medium). Pulls
  boot.initrd.systemd, which also drives the keyboard-at-LUKS feature.
- system.nixos.distroName = "Nomarchy" (os-release PRETTY_NAME,
  systemd-boot entries, ISO menu label). distroId left "nixos" (feeds
  DEFAULT_HOSTNAME + upstream isNixos checks — roadmapped).
- nixpkgs.config.allowUnfree distro-wide (here + both import-nixpkgs
  sites) — unblocks claude-code for the menu's ask-Claude module.
- systemd-boot.configurationLimit = 10 so entries don't fill the ESP.
- Live ISO: nomarchy.idle.enable = false — hypridle was suspending the
  VM mid-install (the install-hung regression); installed systems keep it.
- flake.nix offline pins (verified 0-leak via a foreign-identity
  gap-analysis probe): the repo's own standalone HM gen + inputDerivations,
  mustache-go + stdenv (stylix re-renders base16 per switch), microcode-amd/
  intel (enableRedistributableFirmware activated updateMicrocode →
  source-build cascade), buildEnv's builder.pl, findXMLCatalogs, and the
  representativeInstall mirror (xkb/initrd-systemd/microcode).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

flake.nix

@@ -148,6 +148,7 @@
         specialArgs = { inherit username; };
         modules = [
           self.nixosModules.nomarchy
+          { nomarchy.system.stateFile = ./theme-state.json; }
           ./hosts/default/configuration.nix
         ];
       };
@@ -251,6 +252,20 @@
                       ({ lib, ... }: {
                         nomarchy.system.snapper.enable = true;
                         nomarchy.system.greeter.autoLogin = username;
+                        # The installer writes these (keyboard-everywhere
+                        # incl. the LUKS prompt) — mirror them or the
+                        # initrd/vconsole pins don't match an offline
+                        # install's rebuild set.
+                        console.useXkbConfig = true;
+                        boot.initrd.systemd.enable = true;
+                        # nixos-generate-config keys microcode off
+                        # enableRedistributableFirmware (now on): the
+                        # real machine enables exactly one vendor —
+                        # pin both, or the offline install builds
+                        # amd-ucode/intel-ucode from source (found the
+                        # hard way: the 2700s regression hang).
+                        hardware.cpu.amd.updateMicrocode = true;
+                        hardware.cpu.intel.updateMicrocode = true;
                         swapDevices = [{ device = "/swap/swapfile"; }];
                         boot.resumeDevice = "/dev/disk/by-uuid/00000000-0000-0000-0000-000000000000";
                         boot.kernelParams = [ "resume_offset=1" ];
@@ -298,6 +313,11 @@
                   representativeInstall.config.system.build.etc.inputDerivation
                   representativeInstall.config.system.build.initialRamdisk.inputDerivation
                   template.homeConfigurations.${username}.activationPackage.inputDerivation
+                  # home-files COPIES user-dbus-services instead of
+                  # referencing it (same story as the self pin above) —
+                  # a custom-username install rebuilds home-files and
+                  # needs its direct inputs present.
+                  template.homeConfigurations.${username}.config.home-files.inputDerivation
                 ] ++ [
                   # A theme switch re-renders stylix's base16 templates
                   # (gtk.css, kvantum, …) on the machine: the renderer and
@@ -328,6 +348,18 @@
                   # tries to BUILD remarshal, whose test closure pulls
                   # matplotlib/ffmpeg/x265 (the ~1900-drv cascade).
                   pkgs.remarshal
+                  # system-path/initrd-bin-env are buildEnvs rebuilt per
+                  # machine; their shared builder.pl is build-time-only
+                  # (never in any runtime closure) — an empty env's
+                  # inputDerivation retains it.
+                  (pkgs.buildEnv { name = "nomarchy-pin-buildenv"; paths = [ ]; }).inputDerivation
+                  # /etc/dbus-1 reassembly wants this setup hook.
+                  pkgs.findXMLCatalogs
+                  # nixos-generate-config keys microcode off
+                  # enableRedistributableFirmware (now on): exactly one
+                  # vendor per real machine, so pin both ucode cpios.
+                  pkgs.microcode-amd
+                  pkgs.microcode-intel
 
                   # …and one representative disko script: its tool closure
                   # (file, which, wrapper hooks, …) isn't otherwise on the