feat(installer): sshd opt-in, gsettings replay, live-medium motd stamp

- alvin-install: new sshd screen (default on) + install step. openssh is
  guaranteed into the pacstrap list when requested, and the final banner
  reports whether the enable actually succeeded (SSHD_APPLIED) instead of
  what was selected. The prompt warns that password login uses the same
  password as LUKS, and only mentions the GitHub key import when a
  username was given.
- alvin-install: replay the `gsettings set` commands end-4 logged during
  its setup run with a clean env and a throwaway session bus as the target
  user, then read each key back in a second session to confirm it persisted
  (gvariant_unescape normalizes both '...' and "..." GVariant output). The
  venv check now walks the uv bin/python symlink chain, re-rooting
  absolute hops under $TARGET, since that link dangles on the live medium.
- build: append the build stamp to the live /etc/motd (keeps the installed
  system's motd untouched) and drop alvin-install's install_motd step.
- docs: installer sections in README/AGENTS.md, sshd notes, corrected line
  counts.

airootfs/root/customize_airootfs.sh

@@ -28,9 +28,13 @@ install -m 0644 /root/.live-pacman.conf /etc/pacman.conf
 rm -f /root/.live-pacman.conf
 
 # Build stamp staged by profiledef.sh (absent for non-git, non-CI builds):
-# keep it where alvin-install looks for it, drop the staging copy.
+# keep the stamp file itself as a reference, drop the staging copy, and
+# stamp the live medium's motd so the booted ISO identifies its build (the
+# installed system keeps the stock package motd - alvin-install never
+# writes /etc/motd).
 if [[ -f /root/.iso-build-stamp ]]; then
   install -m 0644 /root/.iso-build-stamp /etc/alvin-build-stamp
+  cat /etc/alvin-build-stamp >> /etc/motd
   rm -f /root/.iso-build-stamp
 fi