fix(impermanence): mark /persist and /home neededForBoot

The impermanence module asserts that the persistent-storage volume and
every volume it bind-mounts into are available in early boot. Persisted
user dirs land under /home, so both /persist and the @home subvolume
must have neededForBoot = true. disko and nixos-generate-config leave it
at the default (false), so a fresh install with impermanence enabled
aborted with:

    All filesystems used for persistent storage must have the option
    "neededForBoot" set to true.
    Please fix the following filesystems: /persist /home

Declare neededForBoot in the module that imposes the requirement.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

core/system/impermanence.nix

@@ -87,6 +87,17 @@ in
       '';
     };
 
+    # The impermanence module asserts that every filesystem it touches is
+    # available in early boot: the persistent-storage volume (/persist) and
+    # any volume it bind-mounts *into* — the user-persistence dirs land under
+    # /home, so the @home subvolume counts too. disko and
+    # nixos-generate-config leave neededForBoot at its default (false) on
+    # these subvolumes, which trips the assertion ("Please fix the following
+    # filesystems: /persist /home"). Declare it here, where the requirement
+    # originates.
+    fileSystems."/persist".neededForBoot = true;
+    fileSystems."/home".neededForBoot = true;
+
     # 2. Persistence Configuration: What survives the wipe
     environment.persistence."/persist" = {
       hideMounts = true;

hosts/nomarchy-live.nix

@@ -81,6 +81,13 @@
   # Allow passwordless sudo for the live user
   security.sudo.wheelNeedsPassword = false;
 
+  # The live accounts have empty passwords, but pam_unix rejects an empty
+  # password by default — which leaves hyprlock unsolvable if the idle
+  # timer locks the session (nothing you can type unlocks it). Allow null
+  # passwords for the locker so it can be dismissed with a bare Enter.
+  # Live-ISO only: installed systems must never accept empty unlocks.
+  security.pam.services.hyprlock.allowNullPassword = true;
+
   # Override the upstream installer helpLine (says "NixOS", points nowhere
   # useful for us). Shown on every TTY before login and again as the MOTD.
   services.getty.helpLine = lib.mkForce ''