fix(install): normalize empty keyboard variants

Treat the picker-only (none) row as an empty XKB variant at the shared input boundary and again in the template patcher. Guard the real downstream output and console keymap, and carry the sentinel through the offline installer VM.

Verified: V0 full flake evaluation plus shell/Python/Nix/diff checks; V1 installer-keyboard, installer-safety, and template-SoT builds; V2 full KVM offline LUKS+swap install and themed first boot. No V3 required.

pkgs/nomarchy-install/nomarchy-install.sh

@@ -222,9 +222,14 @@ else
         KB_VARIANT=$( { echo "(none)"; localectl list-x11-keymap-variants "$KB_LAYOUT" 2>/dev/null; } \
             | gum filter --placeholder "variant for $KB_LAYOUT (pick '(none)' for the default)" \
             || echo "(none)")
-        [[ "$KB_VARIANT" == "(none)" ]] && KB_VARIANT=""
     fi
 fi
+# `(none)` is gum's display-only sentinel, never an XKB variant.  Keep the
+# normalization at the common boundary so interactive and unattended installs
+# cannot write it into either generated Nix file.
+if [[ "$KB_VARIANT" == "(none)" ]]; then
+    KB_VARIANT=""
+fi
 [[ "$USERNAME" =~ ^[a-z_][a-z0-9_-]*$ ]] || fail "Invalid username '$USERNAME'."
 [[ -f "/usr/share/zoneinfo/$TIMEZONE" || -e "/etc/zoneinfo/$TIMEZONE" ]] \
     || timedatectl list-timezones 2>/dev/null | grep -qx "$TIMEZONE" \