feat(installer): sshd opt-in, gsettings replay, live-medium motd stamp

- alvin-install: new sshd screen (default on) + install step. openssh is
  guaranteed into the pacstrap list when requested, and the final banner
  reports whether the enable actually succeeded (SSHD_APPLIED) instead of
  what was selected. The prompt warns that password login uses the same
  password as LUKS, and only mentions the GitHub key import when a
  username was given.
- alvin-install: replay the `gsettings set` commands end-4 logged during
  its setup run with a clean env and a throwaway session bus as the target
  user, then read each key back in a second session to confirm it persisted
  (gvariant_unescape normalizes both '...' and "..." GVariant output). The
  venv check now walks the uv bin/python symlink chain, re-rooting
  absolute hops under $TARGET, since that link dangles on the live medium.
- build: append the build stamp to the live /etc/motd (keeps the installed
  system's motd untouched) and drop alvin-install's install_motd step.
- docs: installer sections in README/AGENTS.md, sshd notes, corrected line
  counts.

README.md

@@ -37,9 +37,10 @@ AlvinArch/
 6. [System Services & Networking](#system-services--networking)
 7. [Local Repository (localrepo/)](#local-repository-localrepo)
 8. [Boot Configuration](#boot-configuration)
-9. [Build & Test](#build--test)
-10. [Planned Additions](#planned-additions)
-11. [Troubleshooting](#troubleshooting)
+9. [Automated Installer (alvin-install)](#automated-installer-alvin-install)
+10. [Build & Test](#build--test)
+11. [Planned Additions](#planned-additions)
+12. [Troubleshooting](#troubleshooting)
 
 ---
 
@@ -50,7 +51,7 @@ AlvinArch/
 ### Key Features
 
 - **Hyprland + end-4** — Wayland compositor with illogical-impulse dotfiles (quickshell, bibata cursors, microtex)
-- **Automated installer (`alvin-install`)** — gum TUI: LUKS with systemd initramfs or experimental touchscreen unl0kr, optional TPM2 auto-unlock, GitHub SSH key import, login manager choice (none/greetd/sddm/gdm), autologin, and a build stamp in `/etc/motd`
+- **Automated installer (`alvin-install`)** — gum TUI: LUKS with systemd initramfs or experimental touchscreen unl0kr, optional TPM2 auto-unlock, GitHub SSH key import, login manager choice (none/greetd/sddm/gdm), optional sshd (on by default), autologin; the build stamp identifies the live ISO via its `/etc/motd`
 - **LazyVim** — Pre-configured Neovim with lazy.nvim and curated plugins
 - **Fish + Zsh + Starship** — Dual shell setup with oh-my-zsh and a cross-shell prompt
 - **Local AUR repo** — Pre-built packages (end-4 deps, wallust, grub-customizer, etc.) that aren't in official repos
@@ -138,7 +139,7 @@ AlvinArch/
 │   │   └── mkinitcpio.conf.d/       # archiso initramfs config
 │   ├── usr/
 │   │   ├── lib/os-release           # usr-merge os-release
-│   │   ├── local/bin/               # choose-mirror, Installation_guide, livecd-sound
+│   │   ├── local/bin/               # alvin-install, choose-mirror, Installation_guide, livecd-sound
 │   │   ├── local/share/livecd-sound/ # ALSA config (asound.conf.in)
 │   │   └── share/pacman/keyrings/   # CachyOS GPG keyring + trust data
 │   └── root/
@@ -305,6 +306,66 @@ Legacy BIOS boot with custom splash screen. Includes PXE network boot config.
 
 ---
 
+## Automated Installer (alvin-install)
+
+The ISO ships an interactive installer at `/usr/local/bin/alvin-install` (source:
+`airootfs/usr/local/bin/alvin-install`, ~1,880 lines of bash; the live `/etc/motd`
+advertises it). It partitions, encrypts, installs, and fully configures a system —
+including the end-4 dotfiles — without network access to this repo.
+
+### Running it
+
+```bash
+alvin-install   # as root on the live medium (root autologins on tty1)
+```
+
+Requirements: **UEFI boot** (it exits if `/sys/firmware/efi` is missing — BIOS/CSM
+is not supported by the installer) and `gum`. A network connection is required and
+verified by pinging `archlinux.org` before any disk is touched; the network screen
+can open `nmtui` for WiFi. Every step is logged to `/var/log/alvin-install.log`,
+which is copied into the installed system.
+
+### What it asks (gum TUI screens)
+
+Keymap → network → target disk (the live USB is hidden from the list) → LUKS
+encryption (optional; **the LUKS passphrase is the same as your login password**)
+→ experimental unl0kr touchscreen unlock → filesystem (`ext4`/`btrfs`) →
+username/password/hostname → git identity + GitHub username (both optional) →
+timezone/locale → login manager → SSH server (enabled by default) → summary.
+
+### What it does
+
+1. GPT partitioning (1 GiB ESP) on the chosen disk, optional LUKS2 on the rest,
+   format + mount at `/mnt`
+2. `pacstrap` with the package list derived from the medium's
+   `pkglist.x86_64.txt` (`pacman -Q` of the live ISO) — `archiso`, `syslinux`,
+   `memtest86+` etc. are dropped, hardcoded essentials (kernel, GRUB,
+   NetworkManager, cryptsetup, microcode) always appended
+3. User account, sudo, git config, GitHub SSH keys (`ssh-import-id`, falling
+   back to `github.com/<user>.keys`)
+4. end-4 dotfiles from the staged `/opt/dots-hyprland` via
+   `./setup install -f -s --skip-alldeps`
+5. Initramfs in one of two modes: **Mode A** — systemd initramfs + `sd-encrypt`
+   (default); **Mode B** — busybox hooks + unl0kr touchscreen unlock
+   (experimental, mutually exclusive with TPM2; falls back to Mode A on failure)
+6. Optional **TPM2 auto-unlock** (`systemd-cryptenroll`, PCR 0+7; passphrase
+   slot kept as fallback; warns if Secure Boot is off)
+7. GRUB (UEFI, boot entry `ALVIN`), login manager — `none` (plain tty, Hyprland
+   autostarts), `greetd`+tuigreet, `sddm`, or `gdm` — falls back to `none` only
+   if the **package** can't be resolved/installed; a failed `systemctl enable`
+   keeps `getty@tty1` as the login path (the summary still reports the chosen
+   manager). Optional autologin (forced off when TPM2 is enrolled), and sshd
+   enabled at boot when selected (default: on) — Arch's stock config allows
+   **password login with the same password as LUKS**, so only accept the default
+   on networks you trust (or harden `sshd_config` afterwards). The final banner
+   reports whether the enable actually succeeded, not just what was selected
+
+On failure an `EXIT` trap unmounts `/mnt` and closes the `cryptroot` mapping, so
+re-running is safe. If the end-4 step reports "incomplete", see the repository's
+`AGENTS.md` Gotchas for the chroot/systemd limitations that cause it.
+
+---
+
 ## Build & Test
 
 ### Building the ISO