Keep provisioning credentials out of OEM installs and factory snapshots

Review findings from codex and Copilot:

- A rig-supplied credentials file in OEM mode now contributes only its LUKS
  passphrase: preserved users/root_enc_password fields would have created a
  hidden provisioning account despite OEM promising no user until first boot.
- The factory snapshot is taken writable, scrubbed of deployment credentials
  (staged authorized_keys, tailscale auth key and join unit, the dead OEM
  LUKS key and its initramfs drop-ins), then set read-only — a reset years
  later must not authorize the original deployment key or rejoin its tailnet.
- The missing-Node-tarball case is a hard install error on every install,
  not just OEM: the stash is what lets a factory reset finalize offline.
- The configurator's OEM gate checks the runtime package for the service
  unit as well as the setup binary.
- The test harness handles the deliberately skipped mode picker on blank
  disks when the bundled runtime lacks OEM support.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

bin/omarchy-iso-test

@@ -614,12 +614,20 @@ drive_configurator() {
   capture_console "success-installer-02-install-disk"
   press ret # the single virtio disk
 
-  wait_for_screen "installation mode" 60
-  capture_console "success-installer-03-install-mode"
-  if $OEM; then
-    press down # "OEM install" sits below "Full disk install" on a blank disk
+  # A blank disk shows the mode picker only when the bundled runtime supports
+  # OEM mode; otherwise the wizard goes straight to the overwrite confirm.
+  wait_for_screen "installation mode\|recovery possible" 60
+  if ocr_screen | grep -qi "installation mode"; then
+    capture_console "success-installer-03-install-mode"
+    if $OEM; then
+      press down # "OEM install" sits below "Full disk install" on a blank disk
+    fi
+    press ret
+  elif $OEM; then
+    capture_console "failure-installer-no-oem-choice"
+    echo "OEM flow requested but this ISO does not offer OEM mode" >&2
+    return 1
   fi
-  press ret
 
   wait_for_screen "recovery possible" 60
   capture_console "success-installer-04-disk-warning-encrypted"