fix(install): normalize empty keyboard variants

Treat the picker-only (none) row as an empty XKB variant at the shared input boundary and again in the template patcher. Guard the real downstream output and console keymap, and carry the sentinel through the offline installer VM.

Verified: V0 full flake evaluation plus shell/Python/Nix/diff checks; V1 installer-keyboard, installer-safety, and template-SoT builds; V2 full KVM offline LUKS+swap install and themed first boot. No V3 required.

docs/ROADMAP.md

@@ -217,6 +217,13 @@ Design/decision records and a running log of shipped work (items marked
   v1: `nomarchy.system.plymouth.*`, background tinted from the state file)
 - Installer round 2: multi-disk BTRFS RAID, impermanence, BIOS/legacy
   boot (v1 `nomarchy-install` is single-disk UEFI — see `pkgs/nomarchy-install`)
+- ✓ **Installer no-keyboard-variant safety (#91):** gum's display-only
+  `(none)` row is normalized at the common interactive/unattended boundary,
+  and the template patcher independently refuses to serialize that sentinel
+  into either Home Manager or system XKB configuration. A permanent check
+  patches the real downstream template for `us` + no variant and builds the
+  resulting console keymap; the full offline installer VM also carries the
+  literal sentinel through LUKS+swap installation and first boot.
 - launch-or-focus UX scripts (swayosd volume/brightness OSD ships since v1:
   `nomarchy.osd.*`, media keys drive `swayosd-client`, themed from the JSON)
 - **Distro branding, round 2:** `distroName = "Nomarchy"` ships