feat(system): Plymouth splash, distroName, allowUnfree, offline-pin hardening

- Plymouth boot splash ported from the legacy branch (modules/nixos/
  plymouth/): logo + eased progress + LUKS entry, background tinted from
  theme-state.json via the new nomarchy.system.stateFile (wired by
  mkFlake/lib.nix; null → Tokyo Night fallback). Default on; OFF on the
  live ISO (boot-message visibility on the install medium). Pulls
  boot.initrd.systemd, which also drives the keyboard-at-LUKS feature.
- system.nixos.distroName = "Nomarchy" (os-release PRETTY_NAME,
  systemd-boot entries, ISO menu label). distroId left "nixos" (feeds
  DEFAULT_HOSTNAME + upstream isNixos checks — roadmapped).
- nixpkgs.config.allowUnfree distro-wide (here + both import-nixpkgs
  sites) — unblocks claude-code for the menu's ask-Claude module.
- systemd-boot.configurationLimit = 10 so entries don't fill the ESP.
- Live ISO: nomarchy.idle.enable = false — hypridle was suspending the
  VM mid-install (the install-hung regression); installed systems keep it.
- flake.nix offline pins (verified 0-leak via a foreign-identity
  gap-analysis probe): the repo's own standalone HM gen + inputDerivations,
  mustache-go + stdenv (stylix re-renders base16 per switch), microcode-amd/
  intel (enableRedistributableFirmware activated updateMicrocode →
  source-build cascade), buildEnv's builder.pl, findXMLCatalogs, and the
  representativeInstall mirror (xkb/initrd-systemd/microcode).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

modules/nixos/default.nix

@@ -11,9 +11,15 @@ let
   cfg = config.nomarchy.system;
 in
 {
-  imports = [ ./options.nix ];
+  imports = [ ./options.nix ./plymouth.nix ];
 
   config = {
+    # The safe half of distro branding: distroName flows into
+    # /etc/os-release PRETTY_NAME, systemd-boot entry titles and the
+    # ISO boot-menu label. distroId stays "nixos" on purpose — it feeds
+    # DEFAULT_HOSTNAME and upstream isNixos checks (see roadmap).
+    system.nixos.distroName = lib.mkDefault "Nomarchy";
+
     # Unfree allowed distro-wide: pragmatic-desktop territory (claude-code
     # for the menu's ask-Claude module, vendor drivers, …). The custom
     # nixpkgs-config type can't carry a nested mkDefault; disagree with
@@ -114,6 +120,9 @@ in
         inter
         noto-fonts
         noto-fonts-color-emoji
+        # The legacy-ported waybar identities (summer-day/night) use
+        # FontAwesome codepoints in their layouts and list it in css.
+        font-awesome
       ];
       fontconfig.defaultFonts = {
         monospace = lib.mkDefault [ "JetBrainsMono Nerd Font" ];
@@ -125,6 +134,31 @@ in
     # ── Essential packages ───────────────────────────────────────────
     environment.systemPackages = with pkgs; [
       nomarchy-theme-sync # provided by overlays.default
+
+      # Friendly wrappers for the two rebuild paths (README §3). Run as
+      # your user: `nix flake update` must NOT run as root (libgit2
+      # refuses the user-owned flake repo) — sudo happens inside, only
+      # for the system switch.
+      (pkgs.writeShellScriptBin "sys-update" ''
+        set -e
+        if [ "$(id -u)" -eq 0 ]; then
+          echo "sys-update: run as your normal user (it sudos the rebuild itself)" >&2
+          exit 1
+        fi
+        flake="''${NOMARCHY_PATH:-$HOME/.nomarchy}"
+        echo "sys-update: updating flake inputs in $flake"
+        nix flake update --flake "$flake"
+        if command -v nixos-rebuild-snap >/dev/null 2>&1; then
+          sudo nixos-rebuild-snap "$@"   # BTRFS snapshot first
+        else
+          sudo nixos-rebuild switch --flake "$flake#default" "$@"
+        fi
+      '')
+      (pkgs.writeShellScriptBin "home-update" ''
+        set -e
+        exec home-manager switch --flake "''${NOMARCHY_PATH:-$HOME/.nomarchy}" "$@"
+      '')
+
       git
       vim
       wget
@@ -152,6 +186,9 @@ in
         nixos-rebuild switch --flake /etc/nixos#default "$@"
       '');
 
+    # Don't let boot entries fill the ESP over the years.
+    boot.loader.systemd-boot.configurationLimit = lib.mkDefault 10;
+
     # ── Nix itself ───────────────────────────────────────────────────
     nix = {
       settings = {