feat(iso): build end-4 deps in-image, ship end4-pC as default shell

- customize_airootfs.sh stages dots-hyprland at /opt, runs ./setup
  install-deps as a throwaway builder, harvests the built packages into
  /opt/localrepo so pacstrap resolves them offline
- image ships its own [local-aur] (file:///opt/localrepo); CI and
  localrepo/update.sh keep that copy in sync; .gitignore covers work/,
  out/ and airootfs/opt/localrepo/
- alvin-install runs ./setup install --skip-alldeps on the target
- clone pctrade/end4-pC into /etc/skel/.config/quickshell, patch qsConfig
  ii -> end4-pC in the staged variables.lua (guarded + idempotent), and
  restore the fork after setup rsync --delete's ~/.config/quickshell
- ship user presets in skel, point fish `q` alias at end4-pC
- AGENTS.md: document the fourth package source and new gotchas

airootfs/root/.live-pacman.conf

@@ -48,4 +48,13 @@ Include = /etc/pacman.d/cachyos-mirrorlist
 
 [chaotic-aur]
 SigLevel = Required DatabaseOptional
-Include = /etc/pacman.d/chaotic-mirrorlist
+Include = /etc/pacman.d/chaotic-mirrorlist
+
+[local-aur]
+# Ships on the medium only: packages built at ISO build time (end-4
+# dependencies, plus localrepo/). Keeps pacstrap from needing the network for
+# anything that is not in the official repos. alvin-install strips this whole
+# section from the target system's pacman.conf, because /opt/localrepo exists
+# only on the live medium.
+SigLevel = Optional TrustAll
+Server = file:///opt/localrepo