Wait for a connection before prompting to update

A ping at hyprland.start answers for a machine that has not finished coming up.
Ethernet is still negotiating DHCP, so a working desktop was told to set up
Wi-Fi and offered an update it could already have run. Ask NetworkManager
instead: -s returns once it has tried every connection it could auto-activate,
which is the first moment the answer means anything, and -x then takes that
answer as it stands rather than waiting out a timeout that a laptop with
nothing to connect to would spend in silence.

The update prompt now waits for a connection rather than being phrased around
not having one. There is nothing to update against until a link lands, and one
usually does land later on the machines that started without it, so the prompt
follows the connection whenever it arrives.

That wait runs detached. It outlasts first run by design, and the keybindings
menu is on screen behind it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/file-layout.md

@@ -238,7 +238,8 @@ systemd instance:
   `install/user/first-run/gtk-primary-paste.sh` — GNOME/GTK settings that
   need the dconf daemon.
 - `install/user/first-run/wifi.sh` — Wi-Fi/update toasts (waits for a live
-  notification server before firing).
+  notification server before firing, then waits detached on `nm-online` so the
+  update prompt only lands once there is a connection).
 - `install/user/first-run/keybindings.sh` — opens the keybindings menu to
   greet the first login; blocks until it is answered.