fix(install): pin build-time deps of per-install drvs; no substituters offline

Offline nixos-install still built from source: the drvs that embed the
user's hostname/username/UUIDs (etc, initrd, toplevel, HM activation)
must be REBUILT, and their builders need tools outside every runtime
closure (etc → python3-minimal, initrd → packing tools). Pin each drv's
inputDerivation into the ISO — the standard nixos-test offline trick.

Also: with no network every substituter query is a DNS retry storm that
ends in a nix goal.cc assertion crash (core dump observed); the installer
now probes connectivity and disables substituters when offline, both on
the live system and inside the nixos-enter HM pre-activation.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

flake.nix

@@ -250,6 +250,17 @@
                   representativeInstall.config.system.build.toplevel
                   template.homeConfigurations.${username}.activationPackage
 
+                  # A real install rebuilds the few drvs that embed the
+                  # user's hostname/username/UUIDs (etc, initrd, toplevel,
+                  # HM activation). Their BUILDERS need tools that are in
+                  # no runtime closure (etc uses python3-minimal, the
+                  # initrd its packing tools) — inputDerivation pins each
+                  # drv's full build inputs.
+                  representativeInstall.config.system.build.toplevel.inputDerivation
+                  representativeInstall.config.system.build.etc.inputDerivation
+                  representativeInstall.config.system.build.initialRamdisk.inputDerivation
+                  template.homeConfigurations.${username}.activationPackage.inputDerivation
+
                   # …and one representative disko script: its tool closure
                   # (file, which, wrapper hooks, …) isn't otherwise on the
                   # ISO, and offline nix would try to build it from source.

pkgs/nomarchy-install/nomarchy-install.sh

@@ -68,6 +68,14 @@ grep -q nomarchy-live /etc/hostname 2>/dev/null \
 export NIX_PATH="nixpkgs=$NOMARCHY_NIXPKGS"
 export NIX_CONFIG="flake-registry = $SHARE/registry.json"
 
+# With no network, every substituter query is a DNS timeout + retry storm
+# (and tickles a nix goal.cc assertion crash). Everything an install needs
+# is pinned into the ISO — drop substituters entirely when offline.
+if ! timeout 3 bash -c '</dev/tcp/cache.nixos.org/443' 2>/dev/null; then
+    info "No network — disabling binary caches (the ISO carries everything)."
+    NIX_CONFIG+=$'\nsubstituters =\nbuilders ='
+fi
+
 # ─── Disk selection ─────────────────────────────────────────────────────
 section "Target disk"
 
@@ -413,6 +421,7 @@ section "Baking the desktop"
 cat > /mnt/tmp/nomarchy-hm-activate.sh <<EOF
 set -e
 export PATH=/run/current-system/sw/bin:\$PATH
+export NIX_CONFIG=$(printf '%q' "$NIX_CONFIG")
 out=\$(nix --extra-experimental-features "nix-command flakes" \
     build --offline --no-link --print-out-paths \
     "/home/$USERNAME/.nomarchy#homeConfigurations.$USERNAME.activationPackage")