packaging/iso: uninstall safety, fail-closed AUR updates, no sshd on live ISO

- tanin-greet.install: post_remove restores the previous greetd config —
  removing the package no longer leaves greetd pointing at a dead binary
- aur-autoupdate: skip packages when the AUR RPC is unreachable instead of
  building blind (fail closed)
- build-tanin-repo: per-package makepkg logs instead of >/dev/null
- live ISO: drop sshd.service enablement (root has an empty password on the
  live medium); encoded in bootstrap-profile.sh so it survives re-bootstrap
- gtklock config: de-personalize hardcoded /home/karim path, mark as
  not-yet-packaged reference
- tanin-desktop PKGBUILD: correct stale AUR-vs-extra comments (gtklock,
  awww, cliphist are in extra), document the eww-git provides=eww contract
- docs/distribution.md: mark SigLevel TrustAll as temporary/insecure, add
  repo-signing TODO (repo-add -s, SigLevel Required), tick done roadmap items
- tanin-calendar + niri-config.kdl: pending session work

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

packaging/tanin-desktop/PKGBUILD

@@ -3,8 +3,9 @@
 # Metapackage: pulls the complete TANINUX (camel) desktop — niri + eww, managed
 # by the TANINUX apps. Own packages come from the [tanin] repo, everything else
 # from the official Arch repos. AUR-only runtime deps (eww, tiramisu, waypaper,
-# cliphist, librewolf-bin, arch-update, timeshift-autosnap, xdg-terminal-exec,
-# paru) are rebuilt into [tanin] so this never hard-depends on the AUR.
+# librewolf-bin, arch-update, timeshift-autosnap, xdg-terminal-exec, paru) are
+# rebuilt into [tanin] so this never hard-depends on the AUR. (cliphist, awww,
+# gtklock + its modules are in official extra -> pulled straight from Arch.)
 # Calamares just installs this package at the end.
 pkgname=tanin-desktop
 pkgver=0.2.0
@@ -40,8 +41,9 @@ depends=(
   'xdg-desktop-portal-gtk'         # Settings/Appearance portal (dark mode!)
   'xdg-desktop-portal-gnome'       # screencast backend recommended for niri
 
-  # --- shell / eww stack (eww, tiramisu, waypaper, cliphist via [tanin]) ---
-  'eww'                            # bar/dock/panels/spotlight
+  # --- shell / eww stack (eww/tiramisu/waypaper via [tanin]; cliphist from extra) ---
+  'eww'                            # bar/dock/panels/spotlight — [tanin] ships eww-git,
+                                   #   which must `provides=(eww)` to satisfy this dep
   'tiramisu-git'                       # headless notification daemon -> eww UI
   'waypaper'                       # wallpaper (niri autostart: waypaper --restore)
   'awww'                           # 2nd wallpaper surface -> blurred niri Overview backdrop (place-within-backdrop)