feat(doctor): first-boot pre-activate fail flag (#83)

If the installer left /var/log/nomarchy-hm-preactivate.log and no Home
Manager generation exists, doctor reports ✖ with the recovery one-liner
(home-manager switch --flake ~/.nomarchy -b bak). Clears once a
generation is present. checks.doctor covers both arms.

Verified: V2 — checks.doctor green; local smoke.

docs/HARDWARE.md

@@ -392,6 +392,7 @@ fix command.
 | fwupd | daemon active; optional “updates pending” warn | `fwupdmgr get-updates` |
 | Battery threshold | if laptop + limit set, sysfs reports it | power docs / restart charge-limit unit |
 | Battery health | cycle_count and/or charge\|energy_full÷design % when sysfs exports them | report-only (warn if <70% of design) |
+| First-boot pre-activate | installer log present + no HM generation | `home-manager switch --flake ~/.nomarchy -b bak` |
 | Hibernate / zram | disk swap + resume=; zram active | docs/MIGRATION.md → Enabling hibernation |
 
 ## 11. Option quick reference

docs/ROADMAP.md

@@ -381,6 +381,11 @@ Design/decision records and a running log of shipped work (items marked
   toast from `nomarchy-rebuild` / `nomarchy-home`; System › What changed?
   (toast + floating full report). `checks.what-changed` fixtures nvd via
   `NOMARCHY_NVD`.
+  ✓ **Doctor first-boot pre-activate (#83, `VISION § A`):** if
+  `/var/log/nomarchy-hm-preactivate.log` exists and no Home Manager
+  generation is present, doctor ✖ with
+  `home-manager switch --flake ~/.nomarchy -b bak`. Skips when log absent;
+  ok once a generation exists. `checks.doctor` covers both arms.
 - ✓ **Hibernate double-unlock:** on resume from hibernate the LUKS
   passphrase already gates the machine, but locking hyprlock before sleep
   meant a second password. Fixed by *not locking* before an encrypted

docs/VISION.md

@@ -59,7 +59,7 @@ The install is already strong. The gap is **after** first boot.
 | **Doctor hardware section** | NM, sink, optional GPU smoke, fprintd, fwupd pending, charge threshold | BACKLOG Hardware product |
 | **Machine health entry** | One System row → doctor (not five submenus) | Menu / doctor |
 | **Human rebuild errors** | On failed switch, point at last log lines + `nomarchy-doctor` | pkgs / menu |
-| **HM pre-activate fail flag** | Durable recovery one-liner on target if bake failed | Installer |
+| **HM pre-activate fail flag** ✓ | Durable recovery one-liner on target if bake failed | ✓ shipped #83 — doctor first-boot row + install-time hint |
 
 Reference: [HARDWARE.md](HARDWARE.md) §4–§5, §10.