Complete archiso/Calamares profile scaffold (iso/)

- Calamares modules: unpackfs (clone), partition/mount/fstab (btrfs subvols),
  bootloader (systemd-boot + quiet splash), packages (strip live), services
  (greetd), shellprocess (snapper, flathub, strip-live), branding (Fuji)
- bootstrap-profile.sh: releng base + linux-zen swap + overlay our deltas
- BUILD.md: build steps, decisions, and honest open items (needs build-test)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

iso/BUILD.md

@@ -0,0 +1,69 @@
+# TANINUX (camel) — ISO build
+
+archiso profile for a **live + Calamares installer** ISO. Model: the live ISO
+**is** the installable system; Calamares clones it to disk (`unpackfs`), then
+configures systemd-boot, Btrfs, services and strips the live-only bits.
+
+## Decisions baked in
+- **Kernel:** linux-zen
+- **Bootloader (target):** systemd-boot (the ISO itself boots systemd-boot/syslinux)
+- **Filesystem:** Btrfs + snapper/snap-pac snapshots (subvol layout: `@`, `@home`,
+  `@cache`, `@log`, `@snapshots`)
+- **Splash:** Plymouth (`quiet splash`, plymouth mkinitcpio hook)
+- **Login:** greetd + tanin-greet (enabled on the target by Calamares)
+- **Preinstalled:** the whole `tanin-desktop` + firefox, thunderbird, kitty,
+  nautilus, flatpak(+Flathub), mpv, loupe, GStreamer codecs, noto fonts/emoji/cjk,
+  file-roller, paru*
+- **Repo:** `[tanin]` (Gitea Arch registry), DB-signing key trusted in the keyring
+
+## Prerequisites
+```sh
+sudo pacman -S archiso          # to build
+```
+- **`[tanin]` must be complete & reachable** (it is: git.openbureau.ch). The build
+  pacman.conf pulls `tanin-desktop` + deps from it (SigLevel=Never at build time).
+- **\*paru is AUR** → it must be rebuilt into `[tanin]` before enabling it in
+  `overrides/packages.x86_64` (currently commented out), or the build fails.
+  (Rebuild like eww-git: `paru-bin` via makepkg → `publish-tanin-repo.sh`.)
+
+## Build
+```sh
+./bootstrap-profile.sh          # assemble build-profile/ (releng base + overrides)
+./bootstrap-profile.sh --build  # assemble + mkarchiso -> out/
+# or manually:
+sudo mkarchiso -v -w /tmp/tanin-work -o out build-profile
+```
+
+## How it fits together
+- `overrides/` holds only our deltas; `bootstrap-profile.sh` copies the canonical
+  `releng` profile and overlays them (so bootloader/mkinitcpio boilerplate stays
+  authoritative; it also swaps the live kernel `linux` → `linux-zen`).
+- `overrides/pacman.conf` — **build-time** (adds `[tanin]`, SigLevel=Never).
+- `overrides/airootfs/etc/pacman.conf` — **live + target** (`[tanin]` Optional
+  TrustAll; the key is imported by `customize_airootfs.sh`).
+- `overrides/airootfs/root/customize_airootfs.sh` — locale, import `[tanin]` key,
+  enable NetworkManager, plymouth hook, live boots to the installer.
+- Live boot: getty autologin on tty1 → `/root/.bash_profile` → `tanin-installer`
+  → `cage -s -- calamares`.
+- Calamares (`airootfs/etc/calamares/`): `unpackfs` clone → btrfs subvols (mount.conf)
+  → systemd-boot (bootloader.conf) → snapper + Flathub (shellprocess) → enable
+  greetd + strip live bits → done.
+
+## ⚠️ Open items / needs real build-testing (can't validate without mkarchiso+root)
+1. **Calamares end-to-end** — the sequence/module configs are a solid starting
+   point but UNTESTED; expect to iterate (esp. partition/mount/bootloader on real
+   hardware + UEFI).
+2. **snapper on Btrfs** — `create-config` can conflict with the pre-created
+   `/.snapshots` subvol; the shellprocess is tolerant (`|| true`) but verify
+   snapshots actually work (snap-pac before/after pacman).
+3. **systemd-boot + snapshots** — no boot-menu snapshot entries (unlike grub-btrfs);
+   rollback is via `snapper rollback` from a recovery, not the boot menu.
+4. **live-vs-target divergence** — `shellprocess-striplive` removes the live
+   autologin/installer on the target; verify the target boots to greetd, not Calamares.
+5. **Plymouth** — a custom Fuji theme isn't shipped yet (uses the default). Add a
+   `tanin-plymouth` theme later.
+6. **Calamares branding** — no logo/slideshow assets yet (text-only); add `logo.png`
+   + `show.qml` under `branding/tanin/` for polish.
+7. **paru** — rebuild into `[tanin]`, then uncomment in `packages.x86_64`.
+8. **[tanin] key in the live keyring** — `customize_airootfs.sh` imports it; confirm
+   `pacman -Sy` works inside the live env and that Calamares' target pacman trusts it.