fix(install): survive the live ISO offline and its non-interactive bash

Found by running the unattended install in an offline QEMU VM:
- compgen is missing from nixpkgs' non-interactive bash (the package
  shebang) — replaced with plain glob tests in hardware-db and prewipe
- disko's eval resolves <nixpkgs> via NIX_PATH (a dead channel on the
  ISO) and tried channels.nixos.org — export NIX_PATH to the pinned
  nixpkgs source and point the flake registry at an empty baked file
- lock nomarchy by path (the source the ISO carries) instead of
  git+https: git inputs clone even when narHash is known, which kills
  offline installs; `original` keeps the forge URL so a later
  `nix flake update` re-resolves normally. Works from dirty-tree ISOs too.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

pkgs/nomarchy-install/compose-lock.py

@@ -27,8 +27,8 @@ def main() -> None:
     src_lock, out, locked_json, original_json = sys.argv[1:5]
 
     locked = json.loads(locked_json)
-    if not locked.get("rev"):
-        sys.exit("compose-lock: no rev in locked metadata (ISO built from a dirty tree?)")
+    if not locked.get("narHash"):
+        sys.exit("compose-lock: no narHash in locked metadata")
 
     with open(src_lock) as f:
         upstream = json.load(f)
@@ -50,7 +50,8 @@ def main() -> None:
     with open(out, "w") as f:
         json.dump({"nodes": nodes, "root": "root", "version": 7}, f, indent=2)
         f.write("\n")
-    print(f"compose-lock: wrote {out} (nomarchy @ {locked['rev'][:12]})")
+    pin = locked.get("rev", locked["narHash"])[:12]
+    print(f"compose-lock: wrote {out} (nomarchy @ {pin})")
 
 
 if __name__ == "__main__":