fix(install): swap=0 and unattended LUKS fail-closed

Pass bare swapSize "0" when the user wants no swap (was "0G", which
still created @swap). Accept "0"/"0G" in disko-config. Unattended
installs require NOMARCHY_LUKS_PASSPHRASE or explicit NOMARCHY_NO_LUKS=1
instead of silently installing cleartext.

Verified: bash -n; nix-instantiate subvolume sets for 0/0G/16G.
VISION § v1.0 install golden path (workflow test iteration).

agent/BACKLOG.md

@@ -157,16 +157,6 @@ first-boot tips · human rebuild errors · neon-glass quarantine.
 
 ### Bugs / broken behavior (codebase exam 2026-07-09)
 
-- **Installer: swap "none" still creates a 0G swap subvolume**
-  `nomarchy-install.sh` always passes `--argstr swapSize "${SWAP_GB}G"`.
-  When the user chooses 0 (no swap), disko gets `"0G"`, but
-  `disko-config.nix` only treats the exact string `"0"` as no-swap —
-  so it still creates `@swap` with size `0G`. Resume wiring correctly
-  skips (`SWAP_GB != "0"`), so layout and config disagree. Fix: pass
-  bare `"0"` (or teach disko to accept `"0G"`). Cheap pure check /
-  unit test for the swapSize contract would lock this. Cost: small
-  installer + disko-config change; high install-path impact.
-
 - **Waybar doctor indicator never shows an icon**
   `modules/home/waybar.nix` `nomarchy-doctor-status` prints
   `"text":""` on failure. Waybar custom modules with empty `text`
@@ -219,14 +209,6 @@ first-boot tips · human rebuild errors · neon-glass quarantine.
   battery-notify. Cost: small multi-file; `[blocked:hw]` to confirm
   on non-BAT* hardware.
 
-- **Unattended install silently disables LUKS if passphrase unset**
-  Interactive path defaults encrypt-on; unattended without
-  `NOMARCHY_LUKS_PASSPHRASE` installs **unencrypted** with only a log
-  line — no fail-closed. `test-install.sh` always sets a passphrase,
-  so the regression path is untested. Options: require the env var
-  when unattended, or an explicit `NOMARCHY_NO_LUKS=1`. Cost: small
-  policy change in install script + test matrix note.
-
 ### Docs / option-surface drift (codebase exam 2026-07-09)
 
 - **`option-docs` would fail: undocumented `nomarchy.hardware.i2c.*`**
@@ -655,10 +637,9 @@ installer questionnaire.*
 
 #### Bugs (stability contracts — fix, don’t optionalize)
 
-- **Installer swap=0 / unattended LUKS fail-open** — already under
-  *Bugs / broken behavior* above (`"0G"` vs `"0"`; missing
-  `NOMARCHY_LUKS_PASSPHRASE` → cleartext). Same audit reconfirmed both
-  as install-path P0.
+- **Installer swap=0 + unattended LUKS fail-closed** — ✓ shipped
+  (workflow test run 2026-07-09): pass bare `"0"`; disko accepts
+  `"0"`/`"0G"`; unattended needs passphrase or `NOMARCHY_NO_LUKS=1`.
 
 - **Offline mode must not silently fall back to network lock**
   When the network probe fails (or install is offline),