fix(install): carry the full system build closure on the ISO

Round 6 still hit a from-source cascade: every per-machine drv (units,
initrd pieces, dbus config, modules-shrunk) needs its own build tools
(lndir, builder.pl, kmod-dev, nuke-refs, libxslt-bin, …), one level
deeper than targeted inputDerivation pins reach. Use the documented
mechanism instead: system.includeBuildDependencies = true on the
representative install pin. Bigger ISO, networkless installs.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

flake.nix

@@ -229,6 +229,14 @@
                       (./templates/downstream + "/hardware-configuration.nix")
                       (./templates/downstream + "/system.nix")
                       ({ lib, ... }: {
+                        # The whole BUILD closure rides along: a real
+                        # install rebuilds the per-machine drvs (etc,
+                        # units, initrd, …) whose builders need tools
+                        # from no runtime closure. This is the documented
+                        # offline-rebuild mechanism; it is what makes the
+                        # ISO big and the install networkless.
+                        system.includeBuildDependencies = true;
+
                         nomarchy.system.snapper.enable = true;
                         nomarchy.system.greeter.autoLogin = username;
                         swapDevices = [{ device = "/swap/swapfile"; }];
@@ -250,15 +258,8 @@
                   representativeInstall.config.system.build.toplevel
                   template.homeConfigurations.${username}.activationPackage
 
-                  # A real install rebuilds the few drvs that embed the
+                  # The HM activation is rebuilt per-username in the
-                  # user's hostname/username/UUIDs (etc, initrd, toplevel,
+                  # installer chroot; pin its build inputs too.
-                  # HM activation). Their BUILDERS need tools that are in
-                  # no runtime closure (etc uses python3-minimal, the
-                  # initrd its packing tools) — inputDerivation pins each
-                  # drv's full build inputs.
-                  representativeInstall.config.system.build.toplevel.inputDerivation
-                  representativeInstall.config.system.build.etc.inputDerivation
-                  representativeInstall.config.system.build.initialRamdisk.inputDerivation
                   template.homeConfigurations.${username}.activationPackage.inputDerivation
 
                   # …and one representative disko script: its tool closure