feat: close #54 V2 install safety, #33 rofi scrollbar, #43 MOTD tip

#54: permanent checks.installer-safety; test-install-safety harness with
offline compose-fail, LUKS-signature disk warn, and HM-hint FORCE paths.
#33: enable themed rofi scrollbars (generated + all whole-swap .rasi).
#43: MOTD + first-boot tip for System › Firmware (V3 LVFS stays hw-queue).

V2: compose-fail/disk-warn/hm-hint logs green offline; theme-shot
boreal+summer-night menus OK. V0 flake/installer-safety.

flake.nix

@@ -270,6 +270,17 @@
               touch $out
             '';
 
+          # Installer safety guards (item 54): offline compose-lock fail-closed
+          # (no network flake lock), disk-signature warn regex, pre-activate
+          # recovery hint path, password floors. Pure source+regex contract.
+          installer-safety = pkgs.runCommand "nomarchy-installer-safety"
+            { nativeBuildInputs = [ pkgs.python3 ]; }
+            ''
+              python3 ${./tools/check-install-safety.py} \
+                ${./pkgs/nomarchy-install/nomarchy-install.sh}
+              touch $out
+            '';
+
           # The installer's disko arg contract (item 49): swapSize "0"/"0G"
           # (bare "0" is what the swap=0 install passes) must yield NO @swap
           # subvolume, a sized value a correctly-sized one, and withLuks must