feat(system): Plymouth splash, distroName, allowUnfree, offline-pin hardening

- Plymouth boot splash ported from the legacy branch (modules/nixos/
  plymouth/): logo + eased progress + LUKS entry, background tinted from
  theme-state.json via the new nomarchy.system.stateFile (wired by
  mkFlake/lib.nix; null → Tokyo Night fallback). Default on; OFF on the
  live ISO (boot-message visibility on the install medium). Pulls
  boot.initrd.systemd, which also drives the keyboard-at-LUKS feature.
- system.nixos.distroName = "Nomarchy" (os-release PRETTY_NAME,
  systemd-boot entries, ISO menu label). distroId left "nixos" (feeds
  DEFAULT_HOSTNAME + upstream isNixos checks — roadmapped).
- nixpkgs.config.allowUnfree distro-wide (here + both import-nixpkgs
  sites) — unblocks claude-code for the menu's ask-Claude module.
- systemd-boot.configurationLimit = 10 so entries don't fill the ESP.
- Live ISO: nomarchy.idle.enable = false — hypridle was suspending the
  VM mid-install (the install-hung regression); installed systems keep it.
- flake.nix offline pins (verified 0-leak via a foreign-identity
  gap-analysis probe): the repo's own standalone HM gen + inputDerivations,
  mustache-go + stdenv (stylix re-renders base16 per switch), microcode-amd/
  intel (enableRedistributableFirmware activated updateMicrocode →
  source-build cascade), buildEnv's builder.pl, findXMLCatalogs, and the
  representativeInstall mirror (xkb/initrd-systemd/microcode).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

modules/nixos/plymouth.nix

@@ -0,0 +1,87 @@
+# Plymouth boot splash — Nomarchy-branded (ported from the legacy
+# iteration), background tinted from the same theme-state.json that
+# drives the desktop (nomarchy.system.stateFile, wired automatically by
+# lib.mkFlake). One caveat by design: theme switches are Home
+# Manager-only and never touch the initrd, so the splash follows the
+# theme as of the last SYSTEM rebuild (`sys-update`), not the last
+# `nomarchy-theme-sync apply`.
+{ config, lib, pkgs, ... }:
+
+let
+  cfg = config.nomarchy.system;
+
+  state =
+    if cfg.stateFile != null
+    then builtins.fromJSON (builtins.readFile cfg.stateFile)
+    else { };
+  base = lib.removePrefix "#" ((state.colors or { }).base or "#1a1b26");
+
+  # Plymouth's Window.SetBackgroundTopColor takes three floats in
+  # 0.0–1.0; the .plymouth metadata's ConsoleLogBackgroundColor takes a
+  # 0xRRGGBB hex. Nix has no float math: multiply, integer-divide, pad.
+  byteToFloat = n:
+    let
+      thousandths = (n * 1000) / 255;
+      s = toString thousandths;
+      padded =
+        if lib.stringLength s == 1 then "00${s}"
+        else if lib.stringLength s == 2 then "0${s}"
+        else s;
+    in "0.${padded}";
+  channel = off: byteToFloat (lib.fromHexString (lib.substring off 2 base));
+
+  nomarchy-plymouth = pkgs.stdenv.mkDerivation {
+    pname = "nomarchy-plymouth";
+    version = "1.0";
+
+    src = ./plymouth;
+
+    installPhase = ''
+      mkdir -p $out/share/plymouth/themes/nomarchy
+      cp * $out/share/plymouth/themes/nomarchy/
+
+      # Point the .plymouth metadata into the store
+      sed -i "s|/usr/share/plymouth/themes/nomarchy|$out/share/plymouth/themes/nomarchy|g" \
+        $out/share/plymouth/themes/nomarchy/nomarchy.plymouth
+
+      # Bake the theme's base color: RGB floats for the script's
+      # Window.SetBackground* calls, 0xRRGGBB for ConsoleLogBackground.
+      sed -i \
+        -e 's|@BG_R@|${channel 0}|g' \
+        -e 's|@BG_G@|${channel 2}|g' \
+        -e 's|@BG_B@|${channel 4}|g' \
+        $out/share/plymouth/themes/nomarchy/nomarchy.script
+      sed -i 's|@BG_HEX@|${base}|g' \
+        $out/share/plymouth/themes/nomarchy/nomarchy.plymouth
+    '';
+  };
+in
+{
+  config = lib.mkIf cfg.plymouth.enable {
+    # Plymouth wants the systemd initrd (also what applies the keyboard
+    # layout to the LUKS prompt) and a quiet console around it.
+    boot.initrd.systemd.enable = lib.mkDefault true;
+    boot.initrd.verbose = lib.mkDefault false;
+    console.earlySetup = lib.mkDefault true;
+    boot.consoleLogLevel = lib.mkDefault 0;
+
+    boot.plymouth = {
+      enable = lib.mkDefault true;
+      themePackages = lib.mkDefault [ nomarchy-plymouth ];
+      theme = lib.mkDefault "nomarchy";
+    };
+
+    # Not mkDefault: kernelParams is a list other modules add to at
+    # normal priority — a mkDefault def would be dropped entirely,
+    # losing the quiet/splash boot. These merge with the rest.
+    boot.kernelParams = [
+      "quiet"
+      "splash"
+      "loglevel=3"
+      "rd.systemd.show_status=false"
+      "rd.udev.log_level=3"
+      "udev.log_priority=3"
+      "boot.shell_on_fail"
+    ];
+  };
+}