fix(install): pin a representative disko script into the ISO closure

disko builds its format/mount script at install time; offline, the
script's tool closure (file, which, wrapper hooks) wasn't on the ISO and
nix tried to build it from source — which needs the network. Pre-building
one representative script (luks + swap variant) pins every input; the
user's actual invocation then differs only in the final text-generation
derivation, which builds offline in seconds.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

flake.nix

@@ -219,6 +219,20 @@
                 }; in [
                   template.nixosConfigurations.default.config.system.build.toplevel
                   template.homeConfigurations.${username}.activationPackage
+
+                  # …and one representative disko script: its tool closure
+                  # (file, which, wrapper hooks, …) isn't otherwise on the
+                  # ISO, and offline nix would try to build it from source.
+                  # The user's actual args produce a different script drv,
+                  # but with identical inputs — built offline in seconds.
+                  (import "${pkgs.disko}/share/disko/cli.nix" {
+                    inherit pkgs;
+                    mode = "destroy,format,mount";
+                    diskoFile = ./pkgs/nomarchy-install/disko-config.nix;
+                    mainDrive = "/dev/vda";
+                    withLuks = true;
+                    swapSize = "2G";
+                  })
                 ]
               );
           }