feat: nomarchy-install — guided live-ISO installer (disko + mkFlake)

Ported from the previous iteration's installer (3bdfc35), adapted to the
mkFlake world. gum TUI: disk pick, optional LUKS2, user/hostname/timezone,
DMI → nixos-hardware autodetection (hardware-db.sh). disko partitions
GPT + 1 GiB ESP + BTRFS subvolumes; the generated machine flake lands at
~user/.nomarchy (one mkFlake call, /etc/nixos symlinks to it) and
nixos-install makes it bootable (UEFI/systemd-boot, v1 single disk).

Offline by construction: the target flake.lock is composed from the rev
the ISO was built from (compose-lock.py), `nix flake archive` seeds the
target store, and the ISO pre-builds the template system + desktop.
First boot lands themed: the HM generation is pre-activated in chroot.

mkFlake grows two things for this: hardwareProfile now also takes a list
(autodetection emits several common-* modules), and installed systems get
the standalone home-manager CLI from the pinned input. Unattended mode
(NOMARCHY_UNATTENDED=1 + env) documented in docs/TESTING.md §4.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/TESTING.md

@@ -67,7 +67,27 @@ Work through these in order; each one exercises a different layer.
 Items 6 and 8 are the big ones — they prove the all-Home-Manager theming
 model end to end.
 
-## 4. VM-specific gotchas
+## 4. Testing the installer
+
+The installer has an unattended mode for exactly this. Boot the live ISO in
+QEMU **with a second, blank disk attached** (e.g. `-drive
+file=target.img,if=virtio,format=raw` on a 20 G image), then in the live
+terminal:
+
+```sh
+sudo NOMARCHY_UNATTENDED=1 NOMARCHY_DISK=/dev/vda \
+     NOMARCHY_USERNAME=me NOMARCHY_PASSWORD=test \
+     NOMARCHY_FINISH=poweroff nomarchy-install
+```
+
+Then boot the VM again **from the target disk** (drop `-cdrom`). The
+machine must reach the themed desktop on its own — greeter autostart,
+wallpaper, Waybar — and `nomarchy-theme-sync apply <x>` must work. For the
+offline claim, add `restrict=on` to the `-netdev` and re-run the whole
+flow: it must behave identically (requires an ISO built from a clean git
+tree, which is what bakes the rev into the installer).
+
+## 5. VM-specific gotchas
 
 - **No KVM** (e.g. nested without acceleration): everything works but
   `home-manager switch` will be painfully slow. Don't read slowness as
@@ -79,7 +99,7 @@ model end to end.
 - **First theme switch is the slowest**: it evaluates the flake on a RAM
   disk. Subsequent switches reuse the eval cache.
 
-## 5. When something fails
+## 6. When something fails
 
 - Session/login problems: `journalctl -b -u greetd`, then `journalctl
   --user -b`.