feat(system): Plymouth splash, distroName, allowUnfree, offline-pin hardening

- Plymouth boot splash ported from the legacy branch (modules/nixos/
  plymouth/): logo + eased progress + LUKS entry, background tinted from
  theme-state.json via the new nomarchy.system.stateFile (wired by
  mkFlake/lib.nix; null → Tokyo Night fallback). Default on; OFF on the
  live ISO (boot-message visibility on the install medium). Pulls
  boot.initrd.systemd, which also drives the keyboard-at-LUKS feature.
- system.nixos.distroName = "Nomarchy" (os-release PRETTY_NAME,
  systemd-boot entries, ISO menu label). distroId left "nixos" (feeds
  DEFAULT_HOSTNAME + upstream isNixos checks — roadmapped).
- nixpkgs.config.allowUnfree distro-wide (here + both import-nixpkgs
  sites) — unblocks claude-code for the menu's ask-Claude module.
- systemd-boot.configurationLimit = 10 so entries don't fill the ESP.
- Live ISO: nomarchy.idle.enable = false — hypridle was suspending the
  VM mid-install (the install-hung regression); installed systems keep it.
- flake.nix offline pins (verified 0-leak via a foreign-identity
  gap-analysis probe): the repo's own standalone HM gen + inputDerivations,
  mustache-go + stdenv (stylix re-renders base16 per switch), microcode-amd/
  intel (enableRedistributableFirmware activated updateMicrocode →
  source-build cascade), buildEnv's builder.pl, findXMLCatalogs, and the
  representativeInstall mirror (xkb/initrd-systemd/microcode).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

hosts/live.nix

@@ -16,6 +16,11 @@
   # Ghostty silently falls back to the wrong font (seen on the
   # Latitude 5410). Normal priority (100) beats the override.
   fonts.fontconfig.enable = true;
+
+  # No boot splash on the install medium: the installer ISO boots its
+  # own initrd path (squashfs), and visibility of boot messages is
+  # worth more than polish here. Installed systems get the splash.
+  nomarchy.system.plymouth.enable = false;
   xdg.icons.enable = true;
   xdg.mime.enable = true;
   xdg.autostart.enable = true;
@@ -85,6 +90,12 @@
 
   # ── Live-session desktop tweaks ─────────────────────────────────────
   home-manager.users.${username} = {
+    # No idle lock/suspend on the install medium: an offline install
+    # runs 20-30 min unattended, and hypridle would blank the display
+    # then SUSPEND the machine mid-install (it did — the install-hung
+    # regression). Installed systems keep idle management.
+    nomarchy.idle.enable = false;
+
     wayland.windowManager.hyprland.settings = {
       # QEMU (and some panels) report a tiny "preferred" mode; ask for
       # the highest resolution instead.