fix(install): seed target store via nix copy --no-check-sigs

`nix flake archive --to` rejects locally-evaluated source paths ("lacks
a signature by a trusted key"); enumerate the archive tree as JSON and
copy with --no-check-sigs instead.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

pkgs/nomarchy-install/nomarchy-install.sh

@@ -405,11 +405,27 @@ section "Installing (this takes a while)"
 
 # Seed the target store with the flake source + all inputs so the first
 # `nomarchy-theme-sync apply` (and the HM pre-activation below) work
-# before the machine has ever seen a network.
+# before the machine has ever seen a network. Two steps because
+# `flake archive --to` enforces signatures and locally-evaluated source
+# paths have none; plain `nix copy` accepts --no-check-sigs.
 info "Seeding flake inputs into the target store..."
-nix --extra-experimental-features "nix-command flakes" \
-    flake archive --to "local?root=/mnt" "$FLAKE_DIR" >/dev/null \
-    || warn "flake archive failed — first rebuild will need network."
+flake_paths=$(nix --extra-experimental-features "nix-command flakes" \
+    flake archive --json "$FLAKE_DIR" 2>/dev/null \
+    | python3 -c '
+import json, sys
+def walk(node):
+    yield node["path"]
+    for child in node.get("inputs", {}).values():
+        yield from walk(child)
+print("\n".join(walk(json.load(sys.stdin))))')
+if [[ -n "$flake_paths" ]]; then
+    # shellcheck disable=SC2086
+    nix --extra-experimental-features "nix-command flakes" \
+        copy --no-check-sigs --to "local?root=/mnt" $flake_paths \
+        || warn "input seeding failed — first rebuild will need network."
+else
+    warn "flake archive failed — first rebuild will need network."
+fi
 
 nixos-install --no-root-passwd --flake "$FLAKE_DIR#default"
 success "System installed (bootloader in place)"