feat(installer): sshd opt-in, gsettings replay, live-medium motd stamp

- alvin-install: new sshd screen (default on) + install step. openssh is
  guaranteed into the pacstrap list when requested, and the final banner
  reports whether the enable actually succeeded (SSHD_APPLIED) instead of
  what was selected. The prompt warns that password login uses the same
  password as LUKS, and only mentions the GitHub key import when a
  username was given.
- alvin-install: replay the `gsettings set` commands end-4 logged during
  its setup run with a clean env and a throwaway session bus as the target
  user, then read each key back in a second session to confirm it persisted
  (gvariant_unescape normalizes both '...' and "..." GVariant output). The
  venv check now walks the uv bin/python symlink chain, re-rooting
  absolute hops under $TARGET, since that link dangles on the live medium.
- build: append the build stamp to the live /etc/motd (keeps the installed
  system's motd untouched) and drop alvin-install's install_motd step.
- docs: installer sections in README/AGENTS.md, sshd notes, corrected line
  counts.

AGENTS.md

@@ -54,13 +54,50 @@ install them into the target without the network.
 | `bootstrap_packages` | Minimal build-time packages (`base`, `arch-install-scripts`) |
 | `airootfs/root/customize_airootfs.sh` | Runs inside chroot during build: keyrings, skel dotfiles (incl. end4-pC), qsConfig patch, end-4 `install-deps`, package harvest, uv/font pre-warm |
 | `airootfs/root/.live-pacman.conf` | `/etc/pacman.conf` of the built image (adds `[local-aur]` = `file:///opt/localrepo`) |
-| `airootfs/usr/local/bin/alvin-install` | Installer: partitions, pacstrap, LUKS (systemd initramfs **or** experimental unl0kr + optional TPM2 unlock), user, git identity + GitHub SSH keys, login manager (none/greetd/sddm/gdm) + autologin, end-4 dotfiles (`--skip-alldeps`), build-stamp motd, boot |
+| `airootfs/usr/local/bin/alvin-install` | Installer: partitions, pacstrap, LUKS (systemd initramfs **or** experimental unl0kr + optional TPM2 unlock), user, git identity + GitHub SSH keys, login manager (none/greetd/sddm/gdm) + autologin, optional sshd (default on), end-4 dotfiles (`--skip-alldeps`), boot |
 | `localrepo/build-end4-deps.sh` | Non-interactive AUR builds for end-4 dependencies |
 | `localrepo/update.sh` | Regenerates localrepo DB, syncs names to packages.x86_64, syncs `airootfs/opt/localrepo/` |
 
+## alvin-install (installer inside the ISO)
+
+Source: `airootfs/usr/local/bin/alvin-install` (~1,880 lines, **no `.sh` extension**).
+The airootfs overlay ships it as `/usr/local/bin/alvin-install` (mode `0755` forced in
+`profiledef.sh` `file_permissions`), and `/etc/motd` advertises it on the live medium.
+
+- **Invoke**: as root from the live session. Hard requirements: `gum` and UEFI —
+  `check_prereqs` exits if `/sys/firmware/efi` is missing. Log: `/var/log/alvin-install.log`
+  (copied into the target at the end; `ERR` trap prints the failing line).
+- **Structure**: `main()` runs 16 `screen_*` TUI functions (collect answers: welcome, keymap,
+  network, disk, luks, unl0kr, filesystem, username, password, hostname, git, timezone,
+  locale, login manager, sshd, summary) then a fixed order of `install_*` steps
+  (partition → LUKS → format/mount → pacstrap → fstab → repos → timezone → locale →
+  hostname → network → sshd → user → git/SSH → end-4 dots → mkinitcpio → bootloader →
+  TPM/unl0kr → login manager → autologin → cleanup). Screens and install steps are
+  independent — edit one without
+  touching the other. An `EXIT` trap unmounts `$TARGET` and closes `cryptroot` on any exit.
+- **Package list**: `install_pacstrap` builds the *installed* system's list from the medium's
+  `/run/archiso/bootmnt/arch/pkglist.x86_64.txt` (i.e. `pacman -Q` of the live ISO), so
+  `packages.x86_64` changes flow into installed systems. It drops `PKGS_EXCLUDE`
+  (`archiso mkinitcpio-archiso mkinitcpio-nfs-utils syslinux memtest86+`) plus names not
+  resolvable in the live repos, then always appends hardcoded essentials
+  (`base linux linux-firmware linux-cachyos networkmanager grub efibootmgr sudo git …`).
+- **CI never lints it**: the shellcheck step globs only `*.sh`. Check manually after edits:
+  `shellcheck -x -s bash airootfs/usr/local/bin/alvin-install`
+- end-4 quirks (`--skip-alldeps`, `yes i`, end4-pC re-copy) are in [Gotchas](#gotchas) below.
+
+## Verify a single change locally (mirrors CI)
+
+```bash
+shellcheck -x -s bash <script>.sh          # plus the alvin-install command above
+yamllint -d "{extends: relaxed, rules: {document-start: disable, line-length: disable, new-line-at-end-of-file: disable}}" <file>.yaml
+```
+
+`packages.x86_64` syntax: one package per line, `[a-zA-Z0-9._@+\-]+` only, no trailing
+whitespace.
+
 ## Gotchas
 
-- The profile root is the **repo root** (not a `releng/` subdirectory). The CI build-iso workflow uses `mkarchiso -v -w work -o out/ releng` but this is a naming convention — the actual profile files live at the repo root.
+- The profile root is the **repo root** (not a `releng/` subdirectory). CI builds with `mkarchiso -v -w "$PWD/work" -o "$PWD/out" -- "$PWD"` (`.gitea/workflows/build-iso.yaml`), and the local build command above does the same — never pass a `releng` path.
 - `customize_airootfs.sh` clones git repos (oh-my-zsh, lazy.nvim, plugins, end-4 dots) into `/etc/skel` and `/opt` during the ISO build. These require network access at build time but make the live ISO work offline.
 - `customize_airootfs.sh` runs `./setup install-deps -f -s --skip-plasmaintg` as the throwaway user `ii-builder` (end-4's scripts refuse to run as root) and aborts the build if it fails. `--skip-plasmaintg` is deliberate: that optional Firefox widget pulls 410 packages / 526 MiB of KDE.
 - The `[local-aur]` repo path in `pacman.conf` (`file:///home/alvin/alvinarch/localrepo`) is for local builds only. The CI does not use this path.
@@ -72,4 +109,4 @@ install them into the target without the network.
 - End-4 metapackages are built from `localrepo/end4-pkgbuilds/` (quickshell-git, bibata-modern-classic-bin, microtex-git).
 - `packages.x86_64` is sorted alphabetically. Keep it sorted when adding/removing entries.
 - `airootfs/opt/localrepo/` is a build artifact (gitignored) — never commit it.
-- **Build stamp flow**: `profiledef.sh` (sourced by mkarchiso) stages the gitignored `airootfs/root/.iso-build-stamp` when a `.git` dir exists **or** `CI`/`GITEA_ACTIONS` is set — line reads `AlvinArch build <date> | commit <date> | <4-char hash>` (falls back to `commit unknown` if `git -c safe.directory` can't read the repo; without `.git`/CI no file is staged). `customize_airootfs.sh` installs it as `/etc/alvin-build-stamp` on the live medium, and `alvin-install`'s `install_motd` copies the live `/etc/motd` banner to the target and appends the stamp. If the medium has no stamp, the installed system gets no motd from us.
+- **Build stamp flow**: `profiledef.sh` (sourced by mkarchiso) stages the gitignored `airootfs/root/.iso-build-stamp` when a `.git` dir exists **or** `CI`/`GITEA_ACTIONS` is set — line reads `AlvinArch build <date> | commit <date> | <4-char hash>` (falls back to `commit unknown` if `git -c safe.directory` can't read the repo; without `.git`/CI no file is staged). `customize_airootfs.sh` keeps it as `/etc/alvin-build-stamp` on the live medium **and appends it to the live `/etc/motd`**, so the booted ISO identifies its build. The installed system's motd is never touched by us — `alvin-install` has no motd step (an earlier `install_motd` that copied the banner + stamp into the target was removed on purpose).