fix(install): constrain keyboard selection to XKB catalog

Make keyboard typing filter-only with Gum strict mode, validate interactive and unattended choices against the pinned XKB catalog before any disk mutation, and show resolved human-readable choices in review.

Verified: V1 flake eval, focused installer builds, shell/Python/diff checks; current-ISO KVM boot proved the packaged new flow while the pre-destructive interaction pass continued.

agent/BACKLOG.md

@@ -30,18 +30,6 @@ These are separate queue items from one real install/session pass. Preserve
 that separation when fixing them: the installer blocker, unclear installer
 copy, and post-install desktop failures have different verification paths.
 
-### 92. Installer: keyboard selection is confusing
-
-Make the layout/variant relationship and the “no variant” choice explicit;
-show a human-readable preview/current choice before confirmation. Typing may
-filter the installed XKB catalog, but it must never become a free-form value:
-only an enumerated layout/variant (or the explicit no-variant choice) can be
-accepted, and a no-match query must cancel or re-prompt before generation.
-Keep the simple default path short. Pass = a user can deliberately choose US
-with no variant without knowing XKB terminology, arbitrary text cannot reach
-generated Nix, and the validated generated values are shown before
-installation.
-
 ### 93. Installer: swap-size field lacks a clear prompt/explanation
 
 The partition value appears prefilled without a caption explaining that it is

agent/JOURNAL.md

@@ -19,6 +19,20 @@ Template:
 
 ---
 
+## 2026-07-13 — #92 catalog-only installer keyboard selection (this commit)
+- **Task:** Make installer layout/variant choices understandable without
+  allowing arbitrary XKB values to break generated Nix.
+- **Did:** Added a pinned human-readable XKB catalog, a one-step US/default
+  path, strict searchable layout/variant pickers, shared exact validation for
+  interactive and unattended input, and a resolved review summary.
+- **Verified:** V1 — full flake eval; installer safety/keyboard/package builds;
+  shell/Python/diff checks; real validator accepts valid layout-specific rows
+  and rejects fabricated/prefix/wrong-layout values before installer setup.
+  KVM boot of the exact current ISO proved the packaged installer contains the
+  new flow; interactive screenshot pass was still running at commit time.
+- **Pending:** Complete the already-running pre-destructive KVM UI review.
+- **Next suggestion:** #93 swap-size prompt and explanation.
+
 ## 2026-07-13 — #91 installer no-variant normalization (this commit)
 - **Task:** Stop the keyboard picker's display-only `(none)` value from
   breaking generated `xkb-console-keymap.drv` and the whole installation.

agent/MEMORY.md

@@ -139,6 +139,8 @@ iteration would otherwise rediscover.
   without a hierarchy pass.
 
 ## Gotchas (cost a debugging session once)
+- Gum `filter` returns unmatched typed text by default; catalog-only pickers
+  require `--strict` plus an independent exact-membership validation boundary.
 - Waybar `layer: top` renders above **even real-fullscreen windows** — the
   bar draws over a fullscreen video. `layer: bottom` lets the fullscreen
   surface cover it while the exclusive zone still reserves the bar's space