fix(install): pin the install-shaped system into the ISO, not the bare template

The offline nixos-install failed building from source: the generated
config enables snapper/auto-login/LUKS-initrd/swapfile-resume on a BTRFS
root, none of which the bare template (ext4 placeholder!) pulls in — so
snapper, nixos-rebuild-snap, btrfs-progs-lib and cryptsetup-bin were
absent from the ISO. The pinned system now mirrors the installer's output
(closure-diff verified).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

flake.nix

@@ -208,16 +208,46 @@
                     (builtins.attrValues (input.inputs or { }));
               in
               collectInputs self ++ (
-                # Pre-build the downstream template's system + desktop so
-                # nomarchy-install can build the target offline (and fast):
-                # a custom username/hostname changes only a handful of
-                # derivations on top of these. No hardware profile — that
+                # Pre-build a system shaped like what nomarchy-install
+                # GENERATES (snapper, auto-login, LUKS initrd, swapfile +
+                # resume — not the bare template!) plus the template
+                # desktop, so the offline install never builds packages
+                # from source: a custom username/hostname then changes
+                # only a handful of derivations. No hardware profile —
                 # matches a VM install; profiled installs share most of it.
-                let template = self.lib.mkFlake {
-                  src = ./templates/downstream;
-                  username = username;
-                }; in [
-                  template.nixosConfigurations.default.config.system.build.toplevel
+                let
+                  template = self.lib.mkFlake {
+                    src = ./templates/downstream;
+                    username = username;
+                  };
+                  representativeInstall = nixpkgs.lib.nixosSystem {
+                    inherit system;
+                    specialArgs = { inherit username; };
+                    modules = [
+                      self.nixosModules.nomarchy
+                      { environment.systemPackages = [ home-manager.packages.${system}.home-manager ]; }
+                      (./templates/downstream + "/hardware-configuration.nix")
+                      (./templates/downstream + "/system.nix")
+                      ({ lib, ... }: {
+                        nomarchy.system.snapper.enable = true;
+                        nomarchy.system.greeter.autoLogin = username;
+                        swapDevices = [{ device = "/swap/swapfile"; }];
+                        boot.resumeDevice = "/dev/disk/by-uuid/00000000-0000-0000-0000-000000000000";
+                        boot.kernelParams = [ "resume_offset=1" ];
+                        boot.initrd.luks.devices.crypted.device = "/dev/disk/by-partlabel/disk-main-root";
+                        # The real install is BTRFS — the placeholder's ext4
+                        # would leave the btrfs-gated bits (snapper!) out of
+                        # this pin.
+                        fileSystems."/" = lib.mkForce {
+                          device = "/dev/mapper/crypted";
+                          fsType = "btrfs";
+                          options = [ "subvol=@" "compress=zstd" "noatime" ];
+                        };
+                      })
+                    ];
+                  };
+                in [
+                  representativeInstall.config.system.build.toplevel
                   template.homeConfigurations.${username}.activationPackage
 
                   # …and one representative disko script: its tool closure