fix(install): survive the live ISO offline and its non-interactive bash

Found by running the unattended install in an offline QEMU VM:
- compgen is missing from nixpkgs' non-interactive bash (the package
  shebang) — replaced with plain glob tests in hardware-db and prewipe
- disko's eval resolves <nixpkgs> via NIX_PATH (a dead channel on the
  ISO) and tried channels.nixos.org — export NIX_PATH to the pinned
  nixpkgs source and point the flake registry at an empty baked file
- lock nomarchy by path (the source the ISO carries) instead of
  git+https: git inputs clone even when narHash is known, which kills
  offline installs; `original` keeps the forge URL so a later
  `nix flake update` re-resolves normally. Works from dirty-tree ISOs too.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

pkgs/nomarchy-install/default.nix

@@ -18,10 +18,13 @@
 , templateDir              # templates/downstream (home.nix, theme-state.json)
 , nomarchyLock             # the distro's flake.lock (for offline lock composition)
 , hardwareModuleNames      # newline-separated nixos-hardware module names
+, nixpkgsPath              # pinned nixpkgs source (NIX_PATH for disko's eval)
 , flakeUrl                 # flake-style URL written into the generated flake.nix
 , lockedNode               # attrset: the flake.lock "locked" node for nomarchy
-                           # (rev = null when the ISO was built from a dirty tree)
-, originalNode             # attrset: the flake.lock "original" node
+                           # (path-type: resolves from the ISO store, offline)
+, originalNode             # attrset: the flake.lock "original" node (the forge,
+                           # so `nix flake update` later re-resolves normally)
+, rev ? null               # informational: rev the ISO was built from
 }:
 
 stdenvNoCC.mkDerivation {
@@ -44,6 +47,8 @@ stdenvNoCC.mkDerivation {
     install -Dm644 compose-lock.py "$share/compose-lock.py"
     install -Dm644 ${nomarchyLock} "$share/flake.lock"
     install -Dm644 ${hardwareModuleNames} "$share/hardware-modules.txt"
+    # Empty flake registry: no network lookups for indirect refs.
+    echo '{"flakes":[],"version":2}' > "$share/registry.json"
     mkdir -p "$share/template"
     cp ${templateDir}/home.nix ${templateDir}/theme-state.json "$share/template/"
 
@@ -55,8 +60,9 @@ stdenvNoCC.mkDerivation {
         util-linux gptfdisk parted cryptsetup lvm2 pciutils btrfs-progs
       ]} \
       --set NOMARCHY_INSTALL_SHARE "$share" \
+      --set NOMARCHY_NIXPKGS ${nixpkgsPath} \
       --set NOMARCHY_FLAKE_URL ${lib.escapeShellArg flakeUrl} \
-      --set NOMARCHY_REV ${lib.escapeShellArg (toString (lockedNode.rev or ""))} \
+      --set NOMARCHY_REV ${lib.escapeShellArg (toString rev)} \
       --set NOMARCHY_LOCKED_JSON ${lib.escapeShellArg (builtins.toJSON lockedNode)} \
       --set NOMARCHY_ORIGINAL_JSON ${lib.escapeShellArg (builtins.toJSON originalNode)}