fix(installer): harden multi-disk LUKS, password handling, revision pinning

Several installer reliability fixes that were left uncommitted:

- Impermanence + multi-disk LUKS: disko-config.nix names the main LUKS
  mapping `crypted` for single-disk and `crypted_main` once extraDrives is
  non-empty. The impermanence rollback hook used to hardcode `crypted`,
  which made every multi-disk install fail to mount root in initrd. Added
  a `nomarchy.system.impermanence.mainLuksName` option and wired the
  installer to write the correct value into the generated system.nix
  based on the drive count.

- Password no longer cleartext in /etc/nixos: installer now hashes the
  user password with `mkpasswd -m sha-512` and emits
  `initialHashedPassword` instead of `initialPassword`. Added mkpasswd to
  the live ISO. Cleartext is unset immediately after hashing.
  USER_PASSWORD_HASH is deliberately not persisted in --resume state —
  configure_user re-prompts on resume.

- Revision pinning that actually works on the live ISO: `inputs.self`
  strips .git in the Nix store copy, so `git rev-parse HEAD` would silently
  return empty on a real install and the generated flake would track main.
  Live ISO now writes `/etc/nomarchy-rev` from `inputs.self.rev` at build
  time; install.sh reads it first, falls back to git, and aborts with a
  loud confirmation prompt if both are empty (instead of silently
  installing an unpinned system).

- Generated `/mnt/etc/nixos/state.json`: toggle scripts (nomarchy-tz-select,
  nomarchy-setup-{fido2,fingerprint}, nomarchy-toggle-hybrid-gpu,
  nomarchy-wifi-powersave) `jq` this file in place and fail hard if it
  doesn't exist. Fresh installs now ship a schema-conformant file matching
  lib/state-schema.nix.

- Unmount /mnt before exiting `finish()` regardless of reboot choice. Clean
  unmount avoids dirty BTRFS on reboot; on "no", leaving /mnt mounted
  blocked a second installer run on the same live ISO.

- Removed obsolete `installer/disko-btrfs-luks.nix` (superseded by
  `disko-config.nix` per commit 3aadc36) and dropped its dangling
  `docs/STRUCTURE.md` reference.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

hosts/nomarchy-live.nix

@@ -22,6 +22,7 @@
     parted
     btrfs-progs
     cryptsetup
+    mkpasswd
     inputs.disko.packages.${pkgs.stdenv.hostPlatform.system}.disko
     (pkgs.makeDesktopItem {
       name = "install-nomarchy";
@@ -64,6 +65,15 @@
 
   environment.etc."nomarchy".source = inputs.self;
 
+  # Embed the git revision the ISO was built from so install.sh can pin the
+  # generated flake to the exact same commit. `inputs.self.rev` exists only
+  # when the flake is built from a clean git tree; from a dirty worktree we
+  # fall back to dirtyRev (which won't be resolvable by `git+https`, so the
+  # installer treats it as "unpinned"). Empty file = unpinned.
+  environment.etc."nomarchy-rev".text =
+    if inputs.self ? rev then inputs.self.rev
+    else "";
+
   # Auto-login to the graphical session
   services.displayManager.autoLogin.enable = true;
   services.displayManager.autoLogin.user = "nixos";