feat(doctor): first-boot pre-activate fail flag (#83)

If the installer left /var/log/nomarchy-hm-preactivate.log and no Home
Manager generation exists, doctor reports ✖ with the recovery one-liner
(home-manager switch --flake ~/.nomarchy -b bak). Clears once a
generation is present. checks.doctor covers both arms.

Verified: V2 — checks.doctor green; local smoke.

pkgs/nomarchy-doctor/nomarchy-doctor.sh

@@ -127,6 +127,33 @@ else
   skip "snapper (not enabled on this machine)"
 fi
 
+# ── first-boot HM pre-activate (installer fail flag, BACKLOG #83) ────
+# Installer writes /var/log/nomarchy-hm-preactivate.log on the target.
+# If that log exists and there is still no Home Manager generation, the
+# desktop never baked — print the recovery one-liner. Override log path
+# with NOMARCHY_HM_PREACTIVATE_LOG for checks.doctor.
+pre_log="${NOMARCHY_HM_PREACTIVATE_LOG:-/var/log/nomarchy-hm-preactivate.log}"
+hm_gen_present=0
+uid_name="${USER:-$(id -un 2>/dev/null || echo)}"
+for d in \
+  "${XDG_STATE_HOME:-${HOME:-}/.local/state}/nix/profiles" \
+  "/nix/var/nix/profiles/per-user/${uid_name}"; do
+  [ -n "$d" ] || continue
+  if [ -e "$d/home-manager" ] \
+     || ls -d "$d"/home-manager-[0-9]*-link >/dev/null 2>&1; then
+    hm_gen_present=1
+    break
+  fi
+done
+if [ ! -r "$pre_log" ]; then
+  skip "first-boot pre-activate (no installer log — not a failed bake)"
+elif [ "$hm_gen_present" -eq 1 ]; then
+  ok "first-boot pre-activate: desktop generation is present"
+else
+  bad "desktop was not pre-activated at install (no Home Manager generation)" \
+      "home-manager switch --flake ~/.nomarchy -b bak  (details: $pre_log)"
+fi
+
 # ══ hardware ═════════════════════════════════════════════════════════
 # Every check below self-gates: it skips cleanly when the tool, service,
 # or device isn't present, so the section shrinks to fit the machine and