feat(install): #61 review Source line tracks offline/online

Gate the Review panel Source wording on the same OFFLINE flag as the
cache.nixos.org probe (ISO-only vs may use network binary caches).
Extend installer-safety pure contract so both phrases and $SOURCE_NET
cannot regress.

Also promote Bernardo-accepted A/B/C batch → NEXT #55–#63 and close #61.

Verified: V0 (check-install-safety + bash -n + checks.installer-safety).

tools/check-install-safety.py

@@ -3,11 +3,13 @@
 
 Usage: check-install-safety.py <nomarchy-install.sh>
 
-Locks the three BACKLOG #54 guards against silent regression:
+Locks the BACKLOG #54 safety guards (+ #61 review Source line) against
+silent regression:
 
   1. Offline compose-lock failure fail-closes (no network `flake lock`).
   2. Disk signature warn for NTFS / BitLocker / Microsoft / LUKS.
   3. HM pre-activate failure drops NOMARCHY-DESKTOP-NOT-THEMED.txt.
+  4. Review panel Source line tracks the same OFFLINE probe as the install path.
 
 Also re-checks the password ≥8 interactive floors (V0-complete).
 Pure — no VM, no ISO.
@@ -129,4 +131,38 @@ check(
     "min-8 length checks missing",
 )
 
+# ── 4. Review Source line tracks OFFLINE (BACKLOG #61) ──────────────────
+check(
+    "pinned into the ISO, no network needed" in script,
+    "missing offline Review Source wording",
+)
+check(
+    "may use network binary caches" in script,
+    "missing online Review Source wording",
+)
+check(
+    re.search(
+        r'if \[\[ "\$OFFLINE" == true \]\]; then\s*\n'
+        r'\s*SOURCE_NET="pinned into the ISO, no network needed"',
+        script,
+    ),
+    "offline Source wording is not gated on OFFLINE=true via SOURCE_NET",
+)
+check(
+    'SOURCE_NET="pinned into the ISO; may use network binary caches"' in script,
+    "online SOURCE_NET assignment missing",
+)
+# Source gum line must expand $SOURCE_NET (not hardcode offline-only text).
+# The line embeds nested quotes, so match from Source: through SOURCE_NET.
+check(
+    re.search(r'"Source:\s+nomarchy.*\$SOURCE_NET"', script, re.DOTALL)
+    is not None,
+    "Source gum line missing or does not expand $SOURCE_NET",
+)
+# The only "no network needed" occurrence must be the offline SOURCE_NET assign.
+check(
+    script.count("no network needed") == 1,
+    "offline Source phrase should appear exactly once (SOURCE_NET assign)",
+)
+
 print("installer-safety: all contracts hold")