feat(flake): add consumer template (nix flake init -t)

Expose templates.default — a starter flake that consumes OmniXY as an
input (dependency model): omnixy.lib.mkSystem + nixosModules.omnixy +
a placeholder host. Lets adopters track OmniXY with `nix flake update`
instead of forking. See templates/default/README.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

templates/default/README.md

@@ -0,0 +1,41 @@
+# My Omnixient config
+
+Generated from Omnixient's starter template (`nix flake init -t github:<your-org>/omnixient`).
+You consume Omnixient as a flake **input** — you do not fork it — so
+`nix flake update omni` pulls upstream changes without ever touching
+your files.
+
+## Setup
+
+1. **Edit `flake.nix`** — set the `omni.url` to the real repo, and fill
+   in the `settings` block (user, hostName, timeZone, theme, stateVersion).
+2. **Generate your hardware scan:**
+   ```bash
+   sudo nixos-generate-config --show-hardware-config \
+     > hosts/myhost/hardware-configuration.nix
+   ```
+   (Rename `hosts/myhost` to your hostname if you like; keep `flake.nix` in sync.)
+3. **Pick packs / options** in `hosts/myhost/default.nix`.
+4. **`git add` everything** — flakes only see git-tracked files.
+5. **Build & switch** (first build on a flakes-disabled system needs the flag):
+   ```bash
+   sudo nixos-rebuild switch --flake .#myhost \
+     --extra-experimental-features "nix-command flakes"
+   ```
+
+## Updating
+
+```bash
+nix flake update omni   # pull latest Omnixient (a pinned dependency)
+sudo nixos-rebuild switch --flake .#myhost
+```
+
+This can't conflict with your config — Omnixient is an input, not a checkout.
+Roll back by reverting `flake.lock`. Pin a release with
+`omni.url = "github:<your-org>/omnixient/v1.0.0"`.
+
+## Secrets (optional)
+
+Off by default. To enable, set `omni.secrets.enable = true` and provide
+your own age key + `secrets/omni.yaml` — see Omnixient's
+`docs/getting-started.md`.

templates/default/flake.nix

@@ -0,0 +1,41 @@
+{
+  description = "My NixOS machine(s), built on Omnixient";
+
+  inputs = {
+    # Pin Omnixient. Point this at the canonical repo or your own fork, and
+    # ideally pin a release tag (…/omni/v1.0.0) for reproducible updates:
+    #   nix flake update omni   # pull the latest Omnixient, never touches your config
+    omni.url = "github:<your-org>/omnixient";
+    # Reuse Omnixient's nixpkgs so you evaluate a single package set.
+    nixpkgs.follows = "omni/nixpkgs";
+  };
+
+  outputs =
+    { omni, ... }:
+    let
+      # Your identity + machine settings. Omnixient core reads `settings.theme`;
+      # the home config reads the rest. Edit these.
+      settings = {
+        user = "alice";
+        gitName = "Alice Example";
+        gitEmail = "alice@example.com";
+        hostName = "myhost";
+        timeZone = "America/New_York";
+        theme = "tokyo-night"; # any module under Omnixient's modules/themes/
+        sshKeys = [ ]; # e.g. [ "ssh-ed25519 AAAA… alice@myhost" ]
+        stateVersion = "24.11"; # release you first installed — never change
+      };
+    in
+    {
+      nixosConfigurations.${settings.hostName} = omni.lib.mkSystem settings.hostName {
+        system = "x86_64-linux";
+        user = settings.user;
+        extraSpecialArgs = { inherit settings; };
+        extraHmArgs = { inherit settings; };
+        modules = [
+          omni.nixosModules.omni # Omnixient desktop/system core
+          ./hosts/myhost # your hardware + option choices
+        ];
+      };
+    };
+}

templates/default/hosts/myhost/default.nix

@@ -0,0 +1,33 @@
+# Your host. Replace hardware-configuration.nix with your real scan:
+#   sudo nixos-generate-config --show-hardware-config \
+#     > hosts/myhost/hardware-configuration.nix
+{ settings, ... }:
+{
+  imports = [ ./hardware-configuration.nix ];
+
+  # Omnixient behavior. See Omnixient's docs/packs.md for the full pack catalog.
+  omni = {
+    enable = true;
+    desktop.enable = true;
+    user = settings.user;
+    theme = settings.theme;
+
+    packs.development.enable = true;
+    packs.media.enable = true;
+    # packs.gaming.enable = true;
+    # packs.office.enable = true;
+
+    # Opt into sops-nix secrets only if you need them (see Omnixient's
+    # docs/getting-started.md "Enabling secrets"). Off by default.
+    # secrets.enable = true;
+  };
+
+  # System basics Omnixient core leaves to you:
+  networking.hostName = settings.hostName;
+  time.timeZone = settings.timeZone;
+  nix.settings.experimental-features = [
+    "nix-command"
+    "flakes"
+  ];
+  system.stateVersion = settings.stateVersion;
+}

templates/default/hosts/myhost/hardware-configuration.nix

@@ -0,0 +1,43 @@
+# PLACEHOLDER hardware scan — REPLACE before building on real hardware:
+#   sudo nixos-generate-config --show-hardware-config > hardware-configuration.nix
+#
+# This generic stub only lets the template evaluate. The by-label devices
+# below will NOT match your machine — a real scan captures your actual
+# disks, filesystems, kernel modules, and CPU microcode.
+#
+# hostPlatform is set by Omnixient's mkSystem; the bootloader (systemd-boot)
+# by Omnixient core — so this file only needs filesystems.
+{
+  config,
+  lib,
+  modulesPath,
+  ...
+}:
+{
+  imports = [ (modulesPath + "/installer/scan/not-detected.nix") ];
+
+  boot.initrd.availableKernelModules = [
+    "xhci_pci"
+    "nvme"
+    "ahci"
+    "usbhid"
+    "sd_mod"
+  ];
+  boot.initrd.kernelModules = [ ];
+  boot.kernelModules = [ ];
+  boot.extraModulePackages = [ ];
+
+  fileSystems."/" = {
+    device = "/dev/disk/by-label/nixos";
+    fsType = "ext4";
+  };
+
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-label/boot";
+    fsType = "vfat";
+  };
+
+  swapDevices = [ ];
+
+  networking.useDHCP = lib.mkDefault true;
+}