fix(install): normalize empty keyboard variants

Treat the picker-only (none) row as an empty XKB variant at the shared input boundary and again in the template patcher. Guard the real downstream output and console keymap, and carry the sentinel through the offline installer VM.

Verified: V0 full flake evaluation plus shell/Python/Nix/diff checks; V1 installer-keyboard, installer-safety, and template-SoT builds; V2 full KVM offline LUKS+swap install and themed first boot. No V3 required.

agent/HARDWARE-QUEUE.md

@@ -124,10 +124,16 @@ the **T14s** (webcam case).
       (SUPER+? / root menu › Keybindings) now ends in ↩ Back and
       returns to the root picker; spot a couple of submenus (Display,
       VPN › Tailscale) still Back correctly after the audit pass.
-- [ ] **Keyboard hotplug picker (re-verify after in-flake graduation)** —
-      plug an external keyboard post-login, pick a layout in rofi, confirm
-      it applies per-device only, persists in `settings.keyboard.devices`,
-      and graduates into a `device{}` block on the next rebuild.
+- [ ] **Per-device keyboard menu + hotplug restore (re-verify after in-flake
+      graduation)** — update to the current `main`, run `nomarchy-home`, and
+      relogin with an external keyboard already connected. Open System ›
+      Keyboard: both the built-in and external boards must be listed with
+      their current layouts. Pick a different layout for the external board;
+      it must apply only there and persist in `settings.keyboard.devices`.
+      Unplug/replug it: the saved layout must restore without another prompt
+      and graduate into a `device{}` block on the next rebuild. Finally plug
+      a previously unseen keyboard in after login: the automatic picker must
+      appear once and remember that choice too.
 - [ ] **Snapshots restore + rollback exercise** (residual — the
       GUI/polkit half passed on hardware 2026-07-04, a47aa3a): in
       `sudo nomarchy-snapshots`, restore a single file (`undochange`)