fix(build): Verify cachyos and chaotic-aur signatures at ISO build time

Both repos used SigLevel = Optional TrustAll, so unsigned or tampered
packages went straight into the ISO. Inherit Required DatabaseOptional
from [options] and have build-iso import + lsign both signing keys.

Also in build-iso: detach only loop devices backed by the work dir
(losetup -D hit every loop on the runner host) and drop the ?token=
download fallback that put the API token into access logs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

pacman.conf

@@ -76,7 +76,6 @@ LocalFileSigLevel = Optional
 #Include = /etc/pacman.d/mirrorlist
 
 [cachyos]
-SigLevel = Optional TrustAll
 Include = /etc/pacman.d/cachyos-mirrorlist
 
 [core]
@@ -98,7 +97,6 @@ Include = /etc/pacman.d/mirrorlist
 Include = /etc/pacman.d/mirrorlist
 
 [chaotic-aur]
-SigLevel = Optional TrustAll
 Include = /etc/pacman.d/chaotic-mirrorlist
 
 [local-aur]