test(install): #72 installer ↔ template SoT parity check

Guard that nomarchy-install share/template ships byte-identical
flake.nix/system.nix/home.nix/theme-state.json to templates/downstream
(the single machine-seed SoT; default.nix copy list).

- tools/check-template-sot.py — share vs SoT file-set + content
- checks.template-sot — pure python + package path (theme-contrast pattern)
- BACKLOG #72 removed; JOURNAL entry

Verified (V0):
  python3 tools/check-template-sot.py <share/template> templates/downstream
  nix build .#checks.x86_64-linux.template-sot

flake.nix

@@ -294,6 +294,19 @@
               touch $out
             '';
 
+          # Installer share ↔ templates/downstream SoT (item 72): the four
+          # files default.nix copies into share/.../template/ must stay
+          # byte-identical to the checkout template (single machine-seed
+          # SoT; no thinner second catalog). Cheap package build + cmp.
+          template-sot = pkgs.runCommand "nomarchy-template-sot"
+            { nativeBuildInputs = [ pkgs.python3 ]; }
+            ''
+              python3 ${./tools/check-template-sot.py} \
+                ${nomarchyInstall}/share/nomarchy-install/template \
+                ${./templates/downstream}
+              touch $out
+            '';
+
           # The installer's disko arg contract (item 49): swapSize "0"/"0G"
           # (bare "0" is what the swap=0 install passes) must yield NO @swap
           # subvolume, a sized value a correctly-sized one, and withLuks must