fix(install): constrain keyboard selection to XKB catalog

Make keyboard typing filter-only with Gum strict mode, validate interactive and unattended choices against the pinned XKB catalog before any disk mutation, and show resolved human-readable choices in review.

Verified: V1 flake eval, focused installer builds, shell/Python/diff checks; current-ISO KVM boot proved the packaged new flow while the pre-destructive interaction pass continued.

docs/ROADMAP.md

@@ -224,6 +224,12 @@ Design/decision records and a running log of shipped work (items marked
   patches the real downstream template for `us` + no variant and builds the
   resulting console keymap; the full offline installer VM also carries the
   literal sentinel through LUKS+swap installation and first boot.
+- ✓ **Catalog-only installer keyboard selection (#92):** the short default
+  confirms US English with standard keys; non-default layouts and variants
+  are searchable human-readable rows from the pinned XKB catalog. Gum runs
+  in strict mode and a shared exact-membership boundary validates interactive
+  and unattended values before hardware detection, disk changes, or generated
+  Nix. The review panel shows the resolved layout and key behaviour.
 - launch-or-focus UX scripts (swayosd volume/brightness OSD ships since v1:
   `nomarchy.osd.*`, media keys drive `swayosd-client`, themed from the JSON)
 - **Distro branding, round 2:** `distroName = "Nomarchy"` ships