packaging/iso: uninstall safety, fail-closed AUR updates, no sshd on live ISO

- tanin-greet.install: post_remove restores the previous greetd config —
  removing the package no longer leaves greetd pointing at a dead binary
- aur-autoupdate: skip packages when the AUR RPC is unreachable instead of
  building blind (fail closed)
- build-tanin-repo: per-package makepkg logs instead of >/dev/null
- live ISO: drop sshd.service enablement (root has an empty password on the
  live medium); encoded in bootstrap-profile.sh so it survives re-bootstrap
- gtklock config: de-personalize hardcoded /home/karim path, mark as
  not-yet-packaged reference
- tanin-desktop PKGBUILD: correct stale AUR-vs-extra comments (gtklock,
  awww, cliphist are in extra), document the eww-git provides=eww contract
- docs/distribution.md: mark SigLevel TrustAll as temporary/insecure, add
  repo-signing TODO (repo-add -s, SigLevel Required), tick done roadmap items
- tanin-calendar + niri-config.kdl: pending session work

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

packaging/tanin-greet/tanin-greet.install

@@ -22,3 +22,21 @@ EOF
 post_upgrade() {
   _activate
 }
+
+# Package files (incl. the greeter binary greetd is pointed at) are gone by the
+# time post_remove runs, so restore the pre-tanin greetd config we backed up in
+# _activate — otherwise greetd keeps launching a deleted greeter and login breaks.
+post_remove() {
+  local dst=/etc/greetd/config.toml
+  if [ -e "$dst.tanin-bak" ]; then
+    mv -f "$dst.tanin-bak" "$dst"
+    echo ">> tanin-greet: restored the previous greetd config from $dst.tanin-bak" >&2
+  else
+    cat >&2 <<'EOF'
+!! tanin-greet: WARNING — /etc/greetd/config.toml still points at the TANINUX
+!! greeter, which was just REMOVED, and no backup (.tanin-bak) exists to restore.
+!! greetd will fail to start (no login) until you edit /etc/greetd/config.toml
+!! to reference an installed greeter (e.g. agreety) or disable greetd.
+EOF
+  fi
+}