fix(install): converge the offline pin set via derivation-graph gap analysis

Walking the install-shaped toplevel's drv graph against the ISO's actual
path set (tools/gap analysis) found why offline installs kept building
from source:

- system-path is rebuilt on EVERY machine: buildEnv's package-list order
  follows module-graph order, which any hardware profile reshuffles →
  pin its builders (texinfo, getconf)
- greetd.toml embeds the auto-login user and is generated by remarshal;
  building remarshal offline drags its test closure (matplotlib → ffmpeg
  → x265…, ~1900 drvs) → pin pkgs.remarshal
- second-level tools for the always-rebuilt drvs: kmod.dev +
  nukeReferences (modules-shrunk), xorg.lndir (unit dirs), libxslt.bin
  (dbus config), python3Minimal (etc)
- the representative pin now has a vfat /boot like a real install
  (mtools/dosfstools enter systemPackages via the vfat fs-type gate)

Verified on the host: the remaining offline build set for a foreign
username/hostname/UUID config is 66 trivial config drvs + eval-time file
copies from the pinned nixpkgs tree — zero network. Same check for the
per-username HM activation: 15 drvs, offline-clean.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

flake.nix

@@ -235,14 +235,20 @@
                         boot.resumeDevice = "/dev/disk/by-uuid/00000000-0000-0000-0000-000000000000";
                         boot.kernelParams = [ "resume_offset=1" ];
                         boot.initrd.luks.devices.crypted.device = "/dev/disk/by-partlabel/disk-main-root";
-                        # The real install is BTRFS — the placeholder's ext4
-                        # would leave the btrfs-gated bits (snapper!) out of
-                        # this pin.
+                        # The real install is BTRFS with a vfat ESP — the
+                        # placeholder's bare ext4 would leave fs-gated bits
+                        # out of this pin (snapper via btrfs; mtools and
+                        # dosfstools enter systemPackages via vfat!).
                         fileSystems."/" = lib.mkForce {
                           device = "/dev/mapper/crypted";
                           fsType = "btrfs";
                           options = [ "subvol=@" "compress=zstd" "noatime" ];
                         };
+                        fileSystems."/boot" = {
+                          device = "/dev/disk/by-uuid/0000-0000";
+                          fsType = "vfat";
+                          options = [ "umask=0077" ];
+                        };
                       })
                     ];
                   };
@@ -258,6 +264,27 @@
                   representativeInstall.config.system.build.etc.inputDerivation
                   representativeInstall.config.system.build.initialRamdisk.inputDerivation
                   template.homeConfigurations.${username}.activationPackage.inputDerivation
+                ] ++ [
+                  # …and the second-level build tools those rebuilds need
+                  # (their parents are themselves rebuilt, so parent
+                  # inputDerivations don't reach them): kernel-module
+                  # shrinking, unit-dir assembly, dbus config, /etc.
+                  pkgs.kmod.dev
+                  pkgs.nukeReferences
+                  pkgs.xorg.lndir
+                  pkgs.libxslt.bin
+                  pkgs.python3Minimal
+                  # system-path is rebuilt on EVERY machine: buildEnv's
+                  # package-list order follows module-graph order, and any
+                  # hardware profile/import reshuffles it. Its builder
+                  # wants these.
+                  pkgs.texinfo
+                  pkgs.getconf
+                  # greetd.toml embeds the auto-login user and is generated
+                  # by remarshal — without this pin an offline install
+                  # tries to BUILD remarshal, whose test closure pulls
+                  # matplotlib/ffmpeg/x265 (the ~1900-drv cascade).
+                  pkgs.remarshal
 
                   # …and one representative disko script: its tool closure
                   # (file, which, wrapper hooks, …) isn't otherwise on the