fix(install): pass --substituters through nixos-install, not just the env

nixos-install hardcodes --extra-substituters "auto?trusted=1" as a CLI
flag, and flags override NIX_CONFIG for the same setting — so the env
fix never reached the in-target build. nixos-install forwards a
--substituters flag verbatim; use that.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

pkgs/nomarchy-install/nomarchy-install.sh

@@ -75,9 +75,15 @@ export NIX_CONFIG="flake-registry = $SHARE/registry.json"
 # nixos-install builds with --store /mnt and its own "auto?trusted=1"
 # substituter resolves to the TARGET store (i.e. itself), so without
 # this nothing flows from the ISO and nix bootstraps gcc from source.
+NIXOS_INSTALL_OPTS=()
 if ! timeout 3 bash -c '</dev/tcp/cache.nixos.org/443' 2>/dev/null; then
     info "No network — substituting from the ISO store only."
     NIX_CONFIG+=$'\nsubstituters =\nextra-substituters = daemon?trusted=1\nbuilders ='
+    # Must ALSO go through nixos-install as a flag: it passes its own
+    # --extra-substituters "auto?trusted=1", and flags override the env
+    # config for the same setting — without this the in-target build
+    # substitutes from itself (= nothing) and bootstraps gcc from source.
+    NIXOS_INSTALL_OPTS+=(--substituters "daemon?trusted=1")
 fi
 
 # ─── Disk selection ─────────────────────────────────────────────────────
@@ -431,7 +437,7 @@ else
     warn "flake archive failed — first rebuild will need network."
 fi
 
-nixos-install --no-root-passwd --flake "$FLAKE_DIR#default"
+nixos-install --no-root-passwd "${NIXOS_INSTALL_OPTS[@]}" --flake "$FLAKE_DIR#default"
 success "System installed (bootloader in place)"
 
 # Pre-activate the Home Manager generation so the FIRST boot lands in the