feat(system): Plymouth splash, distroName, allowUnfree, offline-pin hardening

- Plymouth boot splash ported from the legacy branch (modules/nixos/
  plymouth/): logo + eased progress + LUKS entry, background tinted from
  theme-state.json via the new nomarchy.system.stateFile (wired by
  mkFlake/lib.nix; null → Tokyo Night fallback). Default on; OFF on the
  live ISO (boot-message visibility on the install medium). Pulls
  boot.initrd.systemd, which also drives the keyboard-at-LUKS feature.
- system.nixos.distroName = "Nomarchy" (os-release PRETTY_NAME,
  systemd-boot entries, ISO menu label). distroId left "nixos" (feeds
  DEFAULT_HOSTNAME + upstream isNixos checks — roadmapped).
- nixpkgs.config.allowUnfree distro-wide (here + both import-nixpkgs
  sites) — unblocks claude-code for the menu's ask-Claude module.
- systemd-boot.configurationLimit = 10 so entries don't fill the ESP.
- Live ISO: nomarchy.idle.enable = false — hypridle was suspending the
  VM mid-install (the install-hung regression); installed systems keep it.
- flake.nix offline pins (verified 0-leak via a foreign-identity
  gap-analysis probe): the repo's own standalone HM gen + inputDerivations,
  mustache-go + stdenv (stylix re-renders base16 per switch), microcode-amd/
  intel (enableRedistributableFirmware activated updateMicrocode →
  source-build cascade), buildEnv's builder.pl, findXMLCatalogs, and the
  representativeInstall mirror (xkb/initrd-systemd/microcode).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

modules/nixos/options.nix

@@ -21,6 +21,22 @@
       '';
     };
 
+    plymouth.enable = lib.mkEnableOption ''
+      the Nomarchy Plymouth boot splash (logo + progress + LUKS prompt),
+      background-tinted from theme-state.json via nomarchy.system.stateFile.
+      Recolors on system rebuilds — theme switches don't touch the initrd'' // { default = true; };
+
+    stateFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      example = lib.literalExpression "./theme-state.json";
+      description = ''
+        theme-state.json for the system-side consumers (currently the
+        Plymouth splash background). lib.mkFlake wires it automatically
+        from your flake; null falls back to the Tokyo Night base color.
+      '';
+    };
+
     audio.enable = lib.mkEnableOption "the Pipewire audio stack" // { default = true; };
     bluetooth.enable = lib.mkEnableOption "Bluetooth support with blueman" // { default = true; };