fix(environment): co-upgrade soname closure when installing installer tools

roles/environment/defaults/main.yml

@@ -9,6 +9,14 @@ environment_pacman_lock_timeout: 120
 environment_pacman_retries: 4
 environment_pacman_retry_delay: 15
 
+# Libraries the installer tools pull whose soname may have bumped past the ISO.
+# Each library's installed reverse-dependencies are upgraded together with the
+# tools so a current install onto an older ISO stays a consistent transaction
+# instead of a partial upgrade. Extend if a future transition breaks the install.
+environment_partial_upgrade_libs:
+  - nettle
+  - leancrypto
+
 # PCI vendor IDs -> vendor codes used by hardware detection.
 # Only vendors that drive distinct firmware/driver packages are mapped.
 environment_pci_vendor_map: