feat: nomarchy-install — guided live-ISO installer (disko + mkFlake)

Ported from the previous iteration's installer (3bdfc35), adapted to the
mkFlake world. gum TUI: disk pick, optional LUKS2, user/hostname/timezone,
DMI → nixos-hardware autodetection (hardware-db.sh). disko partitions
GPT + 1 GiB ESP + BTRFS subvolumes; the generated machine flake lands at
~user/.nomarchy (one mkFlake call, /etc/nixos symlinks to it) and
nixos-install makes it bootable (UEFI/systemd-boot, v1 single disk).

Offline by construction: the target flake.lock is composed from the rev
the ISO was built from (compose-lock.py), `nix flake archive` seeds the
target store, and the ISO pre-builds the template system + desktop.
First boot lands themed: the HM generation is pre-activated in chroot.

mkFlake grows two things for this: hardwareProfile now also takes a list
(autodetection emits several common-* modules), and installed systems get
the standalone home-manager CLI from the pinned input. Unattended mode
(NOMARCHY_UNATTENDED=1 + env) documented in docs/TESTING.md §4.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

pkgs/nomarchy-install/default.nix

@@ -0,0 +1,71 @@
+{ lib
+, stdenvNoCC
+, makeWrapper
+, bash
+, gum
+, disko
+, whois            # mkpasswd
+, git
+, python3
+, util-linux       # lsblk, wipefs, swapoff, lscpu
+, gptfdisk         # sgdisk
+, parted           # partprobe
+, cryptsetup
+, lvm2             # dmsetup
+, pciutils         # lspci
+  # Baked metadata — what this installer installs and where it came from.
+, templateDir              # templates/downstream (home.nix, theme-state.json)
+, nomarchyLock             # the distro's flake.lock (for offline lock composition)
+, hardwareModuleNames      # newline-separated nixos-hardware module names
+, flakeUrl                 # flake-style URL written into the generated flake.nix
+, lockedNode               # attrset: the flake.lock "locked" node for nomarchy
+                           # (rev = null when the ISO was built from a dirty tree)
+, originalNode             # attrset: the flake.lock "original" node
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "nomarchy-install";
+  version = "0.1.0";
+
+  src = ./.;
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 nomarchy-install.sh $out/bin/nomarchy-install
+    patchShebangs $out/bin/nomarchy-install
+
+    share=$out/share/nomarchy-install
+    install -Dm644 disko-config.nix "$share/disko-config.nix"
+    install -Dm644 hardware-db.sh "$share/hardware-db.sh"
+    install -Dm644 compose-lock.py "$share/compose-lock.py"
+    install -Dm644 ${nomarchyLock} "$share/flake.lock"
+    install -Dm644 ${hardwareModuleNames} "$share/hardware-modules.txt"
+    mkdir -p "$share/template"
+    cp ${templateDir}/home.nix ${templateDir}/theme-state.json "$share/template/"
+
+    # nixos-install / nixos-generate-config / nixos-enter / nix / systemd
+    # tools come from the live system on purpose — they must match it.
+    wrapProgram $out/bin/nomarchy-install \
+      --prefix PATH : ${lib.makeBinPath [
+        bash gum disko whois git python3
+        util-linux gptfdisk parted cryptsetup lvm2 pciutils
+      ]} \
+      --set NOMARCHY_INSTALL_SHARE "$share" \
+      --set NOMARCHY_FLAKE_URL ${lib.escapeShellArg flakeUrl} \
+      --set NOMARCHY_REV ${lib.escapeShellArg (toString (lockedNode.rev or ""))} \
+      --set NOMARCHY_LOCKED_JSON ${lib.escapeShellArg (builtins.toJSON lockedNode)} \
+      --set NOMARCHY_ORIGINAL_JSON ${lib.escapeShellArg (builtins.toJSON originalNode)}
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Nomarchy guided installer (disko + mkFlake + nixos-install)";
+    license = lib.licenses.mit;
+    mainProgram = "nomarchy-install";
+    platforms = lib.platforms.linux;
+  };
+}