fix: disk picker fd0 (#112), menu Back guard (#106), offline theme (#113)

- #112: list_installable_disks drops fd/loop/sr/zram/<8GiB, largest-first
  so OVMF no longer offers /dev/fd0 as the default wipe target
- #106: tools/check-menu-back.py + checks.menu-back (proved to fail)
- #113: offline theme-switch contract documented (default/pinned only);
  theme-sync run_switch adds offline-oriented hint when no network

Verified: V0 flake check; installer-safety; menu-back; py_compile.

docs/ROADMAP.md

@@ -404,6 +404,11 @@ Design/decision records and a running log of shipped work (items marked
   decision rather than a drive-by. Proved to fail: dropping snapshot makes it
   name the missing entry. **V3 pending** — that the apps *launch* needs real
   hardware (HARDWARE-QUEUE, Acer M5-481T).
+- ✓ **Fix batch #112 / #106 / #113:** installer disk picker drops fd0/loop/
+  optical/<8 GiB and lists largest-first (OVMF no longer defaults to floppy);
+  `checks.menu-back` guards every internal rofi list emits ↩ Back; offline
+  theme-switch promise scoped to the live-pinned (default) theme with a clear
+  error when a non-pinned preset needs network.
 - ✓ **Install fix batch (#123–#126):** (123) HM pre-activate creates
   `/run/user/$UID` + `dbus-run-session` so dconf no longer aborts the bake;
   (124) main-built ISOs seed `?ref=main` and installer actually rewrites

docs/TESTING.md

@@ -56,8 +56,11 @@ session may not start.
   Hyprland via `initial_session`; logging out lands on tuigreet.
 - The flake is seeded writable at `~/.nomarchy` (from the read-only
   `/etc/nomarchy` copy) — `$NOMARCHY_PATH` already points there.
-- Locked flake inputs are pinned into the ISO store, so
-  `home-manager switch` works **without a network**.
+- Locked flake inputs are pinned into the ISO store, so a
+  `home-manager switch` for the **already-active / default theme** works
+  **without a network**. Switching to an arbitrary other preset can still
+  need downloads (that preset's HM generation is not in the pin) — the
+  tool should fail with an offline-oriented message (#113).
 
 ## 3. Verification checklist
 
@@ -70,7 +73,7 @@ Work through these in order; each one exercises a different layer.
 | 3 | `SUPER+Return` opens Kitty with the default theme colors (Boreal) | terminal default, ANSI palette |
 | 4 | `btop` in the terminal is themed | per-theme asset baking |
 | 5 | `nomarchy-theme-sync list` prints 24 presets | package, baked themes dir |
-| 6 | `nomarchy-theme-sync apply gruvbox` → state written, `home-manager switch` runs, desktop re-themes, wallpaper changes | the whole engine: state write, pure eval, HM rebuild, wallpaper hook |
+| 6 | `nomarchy-theme-sync apply boreal` (or re-apply the **current** theme) offline → switch succeeds. Applying a *different* preset may need a network — the ISO pins the default theme's generation, not every preset (#113) | state write + offline rebuild contract |
 | 7 | `SUPER+SHIFT+T` cycles wallpapers instantly (try `tokyo-night` for 4, or `boreal` for its set) | the runtime wallpaper path |
 | 8 | `nomarchy-theme-sync apply summer-night` → after the switch the bar has its own identity (light bar, different styling) | whole-swap waybar.css assets |
 | 9 | Open a GTK app — dark theme matching the palette | Stylix layer |