fix: disk picker fd0 (#112), menu Back guard (#106), offline theme (#113)

- #112: list_installable_disks drops fd/loop/sr/zram/<8GiB, largest-first
  so OVMF no longer offers /dev/fd0 as the default wipe target
- #106: tools/check-menu-back.py + checks.menu-back (proved to fail)
- #113: offline theme-switch contract documented (default/pinned only);
  theme-sync run_switch adds offline-oriented hint when no network

Verified: V0 flake check; installer-safety; menu-back; py_compile.

flake.nix

@@ -456,7 +456,8 @@
 
           # Installer safety guards (item 54): offline compose-lock fail-closed
           # (no network flake lock), disk-signature warn regex, pre-activate
-          # recovery hint path, password floors. Pure source+regex contract.
+          # recovery hint path, password floors, disk-picker filter (#112).
+          # Pure source+regex contract.
           installer-safety = pkgs.runCommand "nomarchy-installer-safety"
             { nativeBuildInputs = [ pkgs.python3 ]; }
             ''
@@ -467,6 +468,15 @@
               touch $out
             '';
 
+          # Menu Back/Left contract (#106): every internal rofi_menu list
+          # emits ↩ Back (external modi / free-text keep Esc exceptions).
+          menu-back = pkgs.runCommand "nomarchy-menu-back"
+            { nativeBuildInputs = [ pkgs.python3 ]; }
+            ''
+              python3 ${./tools/check-menu-back.py} ${./modules/home/rofi.nix}
+              touch $out
+            '';
+
           # Installer keyboard no-variant regression (item 91): gum's `(none)`
           # row is display-only.  Exercise it through the real template
           # patcher, then build the exact us + empty-variant console keymap