feat(flake): add consumer template (nix flake init -t)

Expose templates.default — a starter flake that consumes OmniXY as an
input (dependency model): omnixy.lib.mkSystem + nixosModules.omnixy +
a placeholder host. Lets adopters track OmniXY with `nix flake update`
instead of forking. See templates/default/README.md.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

templates/default/README.md

@@ -0,0 +1,41 @@
+# My Omnixient config
+
+Generated from Omnixient's starter template (`nix flake init -t github:<your-org>/omnixient`).
+You consume Omnixient as a flake **input** — you do not fork it — so
+`nix flake update omni` pulls upstream changes without ever touching
+your files.
+
+## Setup
+
+1. **Edit `flake.nix`** — set the `omni.url` to the real repo, and fill
+   in the `settings` block (user, hostName, timeZone, theme, stateVersion).
+2. **Generate your hardware scan:**
+   ```bash
+   sudo nixos-generate-config --show-hardware-config \
+     > hosts/myhost/hardware-configuration.nix
+   ```
+   (Rename `hosts/myhost` to your hostname if you like; keep `flake.nix` in sync.)
+3. **Pick packs / options** in `hosts/myhost/default.nix`.
+4. **`git add` everything** — flakes only see git-tracked files.
+5. **Build & switch** (first build on a flakes-disabled system needs the flag):
+   ```bash
+   sudo nixos-rebuild switch --flake .#myhost \
+     --extra-experimental-features "nix-command flakes"
+   ```
+
+## Updating
+
+```bash
+nix flake update omni   # pull latest Omnixient (a pinned dependency)
+sudo nixos-rebuild switch --flake .#myhost
+```
+
+This can't conflict with your config — Omnixient is an input, not a checkout.
+Roll back by reverting `flake.lock`. Pin a release with
+`omni.url = "github:<your-org>/omnixient/v1.0.0"`.
+
+## Secrets (optional)
+
+Off by default. To enable, set `omni.secrets.enable = true` and provide
+your own age key + `secrets/omni.yaml` — see Omnixient's
+`docs/getting-started.md`.