Reorder configurator: disk before keyboard, skip keyboard for OEM

The wizard now opens on disk selection; keyboard moves to after the install
mode is chosen and stays before the user step (so the LUKS passphrase is
still typed under the chosen layout). OEM installs skip keyboard and user
entirely — the machine's owner picks both at first boot — so the emitted
config just carries a default 'us' keymap as a placeholder.

The QEMU harness drives the new order and the OEM first-boot keyboard step.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

bin/omarchy-iso-test

@@ -606,19 +606,16 @@ audio-panel|meta_l-ctrl-a|omarchy-keyboard-panel|omarchy.audio'
 drive_configurator() {
   log "Driving the installer wizard"
 
-  wait_for_screen "keyboard layout" 300
-  capture_console "success-installer-01-keyboard-layout"
-  press ret # English (US) is preselected
-
-  wait_for_screen "install disk" 120
-  capture_console "success-installer-02-install-disk"
+  # Disk first (the keyboard step moved after mode selection, and OEM skips it).
+  wait_for_screen "install disk" 300
+  capture_console "success-installer-01-install-disk"
   press ret # the single virtio disk
 
   # A blank disk shows the mode picker only when the bundled runtime supports
   # OEM mode; otherwise the wizard goes straight to the overwrite confirm.
   wait_for_screen "installation mode\|recovery possible" 60
   if ocr_screen | grep -qi "installation mode"; then
-    capture_console "success-installer-03-install-mode"
+    capture_console "success-installer-02-install-mode"
     if $OEM; then
       press down # "OEM install" sits below "Full disk install" on a blank disk
     fi
@@ -630,21 +627,25 @@ drive_configurator() {
   fi
 
   wait_for_screen "recovery possible" 60
-  capture_console "success-installer-04-disk-warning-encrypted"
+  capture_console "success-installer-03-disk-warning-encrypted"
   if ! $ENCRYPT; then
     press ctrl-c # toggles the confirm to the unencrypted flow
     wait_for_screen "without encryption" 30
-    capture_console "success-installer-05-disk-warning-unencrypted"
+    capture_console "success-installer-04-disk-warning-unencrypted"
   fi
   press ret
 
   if $OEM; then
-    # OEM installs skip the user step entirely; the install starts right away.
+    # OEM installs skip the keyboard and user steps; the install starts now.
     sleep 2
     capture_console "success-installer-13-install-started"
     return 0
   fi
 
+  wait_for_screen "keyboard layout" 60
+  capture_console "success-installer-05-keyboard-layout"
+  press ret # English (US) is preselected
+
   wait_for_screen "Username" 120
   type_text "$GUEST_USER"
   capture_console "success-installer-06-username"
@@ -693,14 +694,19 @@ drive_configurator() {
 drive_oem_setup() {
   log "Driving the OEM first-boot setup"
 
-  wait_for_screen "Username" 600
-  capture_console "success-oem-01-username"
+  # OEM defers the keyboard step to first boot; it comes before the user form.
+  wait_for_screen "keyboard layout" 600
+  capture_console "success-oem-01-keyboard-layout"
+  press ret # English (US) preselected
+
+  wait_for_screen "Username" 120
+  capture_console "success-oem-02-username"
   type_text "$GUEST_USER"
   press ret
 
   wait_for_screen "Password" 60
   type_text "$GUEST_PASSWORD"
-  capture_console "success-oem-02-password"
+  capture_console "success-oem-03-password"
   press ret
 
   wait_for_screen "Conf *irm" 60
@@ -713,16 +719,16 @@ drive_oem_setup() {
 
   wait_for_screen "Email address" 60
   type_text "test@omarchy.org"
-  capture_console "success-oem-03-email"
+  capture_console "success-oem-04-email"
   press ret
 
   wait_for_screen "look right" 60
-  capture_console "success-oem-04-review"
+  capture_console "success-oem-05-review"
   press ret
 
   # Finalization (offline Node unpack, LUKS re-key on encrypted installs)
   # runs before SDDM appears.
-  capture_console "success-oem-05-finalizing"
+  capture_console "success-oem-06-finalizing"
 }
 
 wait_for_install() {

configs/airootfs/root/configurator

@@ -134,9 +134,9 @@ Ukrainian|ua'
   fi
 }
 
-keyboard_form
-
-# STEP 2: USER (run after the install mode is chosen — OEM installs skip it)
+# Keyboard and user run after the install mode is chosen. OEM installs skip
+# both — the machine's first owner picks their keyboard and creates their user
+# in the first-boot setup, so the OEM operator sets nothing user-specific.
 
 user_form() {
   step "Let's setup your user account..."
@@ -944,9 +944,13 @@ install_target="full_disk"
 disk_form
 select_installation
 
-# STEP 4: USER (OEM installs defer this to the machine's first boot)
+# STEP 3: KEYBOARD + USER (OEM defers both to the machine's first boot)
 
 if $oem_install; then
+  # A defined default keymap so the system boots before first-boot setup; the
+  # owner picks their real layout in the OOBE, which re-keys the console and,
+  # on encrypted installs, rebuilds the initramfs so the LUKS prompt matches.
+  keyboard="us"
   username=""
   password=""
   password_hash=""
@@ -955,6 +959,9 @@ if $oem_install; then
   hostname="omarchy"
   timezone="UTC"
 else
+  # Keyboard before the user step so the LUKS passphrase is typed under the
+  # chosen layout (typing it under the wrong one locks the user out at boot).
+  keyboard_form
   user_step
 fi