fix(install): swap=0 and unattended LUKS fail-closed

Pass bare swapSize "0" when the user wants no swap (was "0G", which
still created @swap). Accept "0"/"0G" in disko-config. Unattended
installs require NOMARCHY_LUKS_PASSPHRASE or explicit NOMARCHY_NO_LUKS=1
instead of silently installing cleartext.

Verified: bash -n; nix-instantiate subvolume sets for 0/0G/16G.
VISION § v1.0 install golden path (workflow test iteration).

pkgs/nomarchy-install/disko-config.nix

@@ -15,12 +15,14 @@
 # proved fragile twice before.
 { mainDrive
 , withLuks ? true
-, swapSize ? "0"   # "0" = no swap; otherwise e.g. "16G" (sized for hibernation)
+, swapSize ? "0"   # "0" or "0G" = no swap; otherwise e.g. "16G" (hibernation-sized)
 , ...
 }:
 
 let
   btrfsMountOptions = [ "compress=zstd" "noatime" ];
+  # Installer historically always appended "G"; accept both "0" and "0G".
+  noSwap = swapSize == "0" || swapSize == "0G";
 
   rootBtrfs = {
     type = "btrfs";
@@ -32,7 +34,7 @@ let
       "@log" = { mountpoint = "/var/log"; mountOptions = btrfsMountOptions; };
       # snapper timeline snapshots (nomarchy.system.snapper.enable)
       "@snapshots" = { mountpoint = "/.snapshots"; mountOptions = btrfsMountOptions; };
-    } // (if swapSize == "0" then { } else {
+    } // (if noSwap then { } else {
       # Hibernation-ready swapfile on its own subvolume; disko's
       # mkswapfile handles the BTRFS NOCOW requirements.
       "@swap" = {