feat(doctor): first-boot pre-activate fail flag (#83)

If the installer left /var/log/nomarchy-hm-preactivate.log and no Home
Manager generation exists, doctor reports ✖ with the recovery one-liner
(home-manager switch --flake ~/.nomarchy -b bak). Clears once a
generation is present. checks.doctor covers both arms.

Verified: V2 — checks.doctor green; local smoke.

docs/ROADMAP.md

@@ -381,6 +381,11 @@ Design/decision records and a running log of shipped work (items marked
   toast from `nomarchy-rebuild` / `nomarchy-home`; System › What changed?
   (toast + floating full report). `checks.what-changed` fixtures nvd via
   `NOMARCHY_NVD`.
+  ✓ **Doctor first-boot pre-activate (#83, `VISION § A`):** if
+  `/var/log/nomarchy-hm-preactivate.log` exists and no Home Manager
+  generation is present, doctor ✖ with
+  `home-manager switch --flake ~/.nomarchy -b bak`. Skips when log absent;
+  ok once a generation exists. `checks.doctor` covers both arms.
 - ✓ **Hibernate double-unlock:** on resume from hibernate the LUKS
   passphrase already gates the machine, but locking hyprlock before sleep
   meant a second password. Fixed by *not locking* before an encrypted