feat(installer): Offer repair chroot on post-pacstrap failure

- offer_chroot(): optional arch-chroot shell into the still-mounted target,
  from install_cleanup() on success and from the EXIT trap when a step fails
  after pacstrap (TARGET_INSTALLED flag); temp NOPASSWD sudoers drop-ins are
  always removed before the shell is opened.
- INT/TERM handler re-exits with 128+N: without it bash runs the EXIT trap
  with $? = 0 for a signal-killed shell and the rc != 0 test would skip the
  offer. A signal during teardown only aborts the prompt (first) so the
  unmount still runs; a second forces the exit.
- cleanup(): report a failed umount -R / cryptsetup close instead of hiding
  stderr, so a repair shell leaving busy mounts is visible before reboot.
- Document the flow in AGENTS.md.

AGENTS.md

@@ -74,7 +74,7 @@ The airootfs overlay ships it as `/usr/local/bin/alvin-install` (mode `0755` for
   locale, login manager, sshd, summary) then a fixed order of `install_*` steps
   (partition → LUKS → format/mount → pacstrap → fstab → repos → timezone → locale →
   hostname → network → sshd → user → git/SSH → end-4 dots → mkinitcpio → bootloader →
-  TPM/unl0kr → login manager (none if unl0kr succeeded; with unl0kr selected the login screen only asks for a fallback) → autologin → update (reflector + keyrings + `pacman -Syu`, warn-only) → cleanup). Screens and install steps are
+  TPM/unl0kr → login manager (none if unl0kr succeeded; with unl0kr selected the login screen only asks for a fallback) → autologin → update (reflector + keyrings + `pacman -Syu`, warn-only) → cleanup, which offers an optional `arch-chroot` shell into the target before unmounting; the `EXIT` trap offers the same shell when a step after pacstrap fails or the install is interrupted (INT/TERM re-exit with 128+N so signals count as failure). Screens and install steps are
   independent — edit one without
   touching the other. An `EXIT` trap unmounts `$TARGET` and closes `cryptroot` on any exit.
 - **Package list**: `install_pacstrap` builds the *installed* system's list from the medium's