feat(system): Plymouth splash, distroName, allowUnfree, offline-pin hardening

- Plymouth boot splash ported from the legacy branch (modules/nixos/
  plymouth/): logo + eased progress + LUKS entry, background tinted from
  theme-state.json via the new nomarchy.system.stateFile (wired by
  mkFlake/lib.nix; null → Tokyo Night fallback). Default on; OFF on the
  live ISO (boot-message visibility on the install medium). Pulls
  boot.initrd.systemd, which also drives the keyboard-at-LUKS feature.
- system.nixos.distroName = "Nomarchy" (os-release PRETTY_NAME,
  systemd-boot entries, ISO menu label). distroId left "nixos" (feeds
  DEFAULT_HOSTNAME + upstream isNixos checks — roadmapped).
- nixpkgs.config.allowUnfree distro-wide (here + both import-nixpkgs
  sites) — unblocks claude-code for the menu's ask-Claude module.
- systemd-boot.configurationLimit = 10 so entries don't fill the ESP.
- Live ISO: nomarchy.idle.enable = false — hypridle was suspending the
  VM mid-install (the install-hung regression); installed systems keep it.
- flake.nix offline pins (verified 0-leak via a foreign-identity
  gap-analysis probe): the repo's own standalone HM gen + inputDerivations,
  mustache-go + stdenv (stylix re-renders base16 per switch), microcode-amd/
  intel (enableRedistributableFirmware activated updateMicrocode →
  source-build cascade), buildEnv's builder.pl, findXMLCatalogs, and the
  representativeInstall mirror (xkb/initrd-systemd/microcode).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

modules/home/swaync.nix

@@ -0,0 +1,92 @@
+# swaync — notification daemon + control centre, themed from
+# theme-state.json. Until this shipped, nothing rendered notify-send at
+# all: the theme-switch progress toasts, the CLI's font warnings and the
+# live ISO's welcome message were all invisible.
+{ config, lib, ... }:
+
+let
+  cfg = config.nomarchy;
+  t = cfg.theme;
+  c = t.colors;
+  r = toString t.ui.rounding;
+in
+{
+  config = lib.mkIf cfg.swaync.enable {
+    services.swaync = {
+      enable = true;
+
+      settings = {
+        positionX = "right";
+        positionY = "top";
+        control-center-margin-top = t.ui.gapsOut;
+        control-center-margin-right = t.ui.gapsOut;
+        control-center-width = 420;
+        notification-window-width = 400;
+        notification-icon-size = 48;
+        timeout = 6;
+        timeout-low = 3;
+        timeout-critical = 0; # critical stays until dismissed
+      };
+
+      style = ''
+        /* Palette baked from theme-state.json */
+        @define-color base ${c.base};
+        @define-color surface ${c.surface};
+        @define-color text ${c.text};
+        @define-color subtext ${c.subtext};
+        @define-color accent ${c.accent};
+        @define-color bad ${c.bad};
+
+        .notification {
+          background: alpha(@base, 0.95);
+          border: ${toString t.ui.borderSize}px solid alpha(@accent, 0.4);
+          border-radius: ${r}px;
+          color: @text;
+        }
+
+        .notification-content .summary {
+          color: @text;
+          font-weight: bold;
+        }
+
+        .notification-content .body {
+          color: @subtext;
+        }
+
+        .notification.critical {
+          border-color: @bad;
+        }
+
+        .control-center {
+          background: alpha(@base, 0.95);
+          border: ${toString t.ui.borderSize}px solid alpha(@accent, 0.4);
+          border-radius: ${r}px;
+          color: @text;
+        }
+
+        .control-center .notification-row:focus,
+        .control-center .notification-row:hover {
+          background: alpha(@surface, 0.6);
+          border-radius: ${r}px;
+        }
+
+        .widget-title {
+          color: @text;
+          font-weight: bold;
+        }
+
+        .widget-title > button {
+          background: @surface;
+          color: @text;
+          border: none;
+          border-radius: ${r}px;
+        }
+
+        .widget-title > button:hover {
+          background: @accent;
+          color: @base;
+        }
+      '';
+    };
+  };
+}