fix(install): pin build-time deps of per-install drvs; no substituters offline

Offline nixos-install still built from source: the drvs that embed the
user's hostname/username/UUIDs (etc, initrd, toplevel, HM activation)
must be REBUILT, and their builders need tools outside every runtime
closure (etc → python3-minimal, initrd → packing tools). Pin each drv's
inputDerivation into the ISO — the standard nixos-test offline trick.

Also: with no network every substituter query is a DNS retry storm that
ends in a nix goal.cc assertion crash (core dump observed); the installer
now probes connectivity and disables substituters when offline, both on
the live system and inside the nixos-enter HM pre-activation.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

flake.nix

@@ -250,6 +250,17 @@
                   representativeInstall.config.system.build.toplevel
                   template.homeConfigurations.${username}.activationPackage
 
+                  # A real install rebuilds the few drvs that embed the
+                  # user's hostname/username/UUIDs (etc, initrd, toplevel,
+                  # HM activation). Their BUILDERS need tools that are in
+                  # no runtime closure (etc uses python3-minimal, the
+                  # initrd its packing tools) — inputDerivation pins each
+                  # drv's full build inputs.
+                  representativeInstall.config.system.build.toplevel.inputDerivation
+                  representativeInstall.config.system.build.etc.inputDerivation
+                  representativeInstall.config.system.build.initialRamdisk.inputDerivation
+                  template.homeConfigurations.${username}.activationPackage.inputDerivation
+
                   # …and one representative disko script: its tool closure
                   # (file, which, wrapper hooks, …) isn't otherwise on the
                   # ISO, and offline nix would try to build it from source.