fix: disk picker fd0 (#112), menu Back guard (#106), offline theme (#113)

- #112: list_installable_disks drops fd/loop/sr/zram/<8GiB, largest-first
  so OVMF no longer offers /dev/fd0 as the default wipe target
- #106: tools/check-menu-back.py + checks.menu-back (proved to fail)
- #113: offline theme-switch contract documented (default/pinned only);
  theme-sync run_switch adds offline-oriented hint when no network

Verified: V0 flake check; installer-safety; menu-back; py_compile.

agent/BACKLOG.md

@@ -72,28 +72,6 @@ buttons in the installer (VM gum screens under Boreal look legible —
 artifacts in `/tmp/nomarchy-v2-swap-93/`). Needs Bernardo's screenshot or
 an Acer repro to pin the actual widget before fixing.
 
-### 113. Live session: offline theme switch rebuilds the world from source
-
-Surfaced by #99's evidence run (2026-07-13, `/tmp/nomarchy-v2-theme-99/`):
-in the **live ISO** session, offline `nomarchy-theme-sync apply gruvbox`
-fails — its `home-manager switch` tries to build **1176 derivations** from
-the `stage0`/`hex0` bootstrap up, then dies on offline source fetches
-(`vala`, `yasm`, `config.jsonc`, `ghostty-config`, `easyeffects.svg`,
-`typogrify`…), ending `error: Build failed due to failed dependency`. This
-contradicts docs/TESTING.md item 6 ("apply gruvbox → switch runs offline").
-The failing generation is `bvl30ggn…-home-manager-generation.drv`; it is
-**not** the drv the ISO pins (the pin is the *default*-theme
-`homeConfigurations.${username}.activationPackage`, i.e. Boreal — confirmed
-drv-identical to the failing one only for gruvbox state, so a non-default
-theme's generation is unpinned). NOT caused by #99's git-seed: the drv is
-byte-identical path-seeded vs git-seeded. **Decide the contract:** either
-pin every baked theme's live activationPackage into the ISO (size cost) or
-scope the offline-switch promise to the shipped theme + correct
-TESTING.md/MEMORY. Pass = a fresh live ISO either switches to any baked
-theme offline, or fails with a clear "needs network for this theme" message
-and accurate docs. **Not caused by anything in today's batch** — separate
-pre-existing ISO-pinning gap.
-
 ## NEXT
 
 ### 122. A crisper Nomarchy logo in fastfetch
@@ -283,14 +261,6 @@ scoped implementation/verification tasks before work starts. Pass = every
 current route has one deliberate home, navigation remains shallow, and no
 root-level entry is added or lost.
 
-### 106. Internal menu Back/Left navigation contract
-
-Reproduce the reported internal leaf with neither Back nor Left behavior, then
-fix any breach of the already-intended navigation contract. Add a permanent
-guard covering every internal leaf; external GUIs and free-text prompts retain
-their explicit Esc exceptions. Pass = no internal leaf can strand the user and
-the guard fails on a regression.
-
 ### 108. Keybindings menu presentation and completeness audit
 
 Group the menu as Window, Workspace, Menu, and Media, then prove every live
@@ -328,16 +298,6 @@ generation, System boot generation, and Files/root BTRFS scopes. Pass = labels
 state what is restored and from where before action, with destructive or reboot
 effects made clear and each existing recovery path represented once.
 
-### 112. Installer disk-picker safety
-
-Exclude floppy, pseudo, tiny, and otherwise non-installable devices such as
-`/dev/fd0`; never select them by default. **Reproduced in QEMU 2026-07-13**
-(#93's V2 run): with OVMF the guest exposes `/dev/fd0` and the picker listed
-it FIRST — a blind Enter selected it (artifacts:
-`/tmp/nomarchy-v2-swap-93/20-review.png`, `Disk: /dev/fd0 (WILL BE ERASED)`). Pass = the real install disk is clear,
-invalid devices cannot reach destructive setup, a permanent guard covers the
-filter/default logic, and a pre-destructive KVM run proves the picker behavior.
-
 ## LATER
 
 - **Wallpapers artifact split** (ROADMAP § Faster switches — decided,