feat(installer): build-stamp motd, LUKS mode A/B, TPM2, unl0kr, login managers

- profiledef.sh stages airootfs/root/.iso-build-stamp (git/CI gated, falls
  back to 'commit unknown'); customize_airootfs.sh installs it as
  /etc/alvin-build-stamp; install_motd appends it to the target /etc/motd
- alvin-install: skippable git/GitHub screens with ssh-import-id import
  (yay build + python-distro, curl .keys fallback), LUKS Mode A (systemd
  sd-encrypt + rd.luks.name) vs Mode B (unl0kr + cryptdevice), TPM2
  enrollment via $PASSWORD with rd.luks.options activation, unl0kr
  build/verify with Mode-A fallback, login manager none/greetd/sddm/gdm
  (enable DM before disabling getty@tty1), autologin per DM (forced off
  when TPM enrolled), build-stamp motd; includes the existing
  GRUB_DISABLE_BOOTNEXT grub tweak
- review fixes: greetd autologin TOML quoting, .ssh chowned before
  ssh-import-id, builtin-aware initramfs module verification across all
  installed kernels, curl exit-code split (fetch failure vs no keys),
  plain Hyprland on every login path
- add curl to packages.x86_64; document stamp flow and installer in
  AGENTS.md/README.md

AGENTS.md

@@ -49,12 +49,12 @@ install them into the target without the network.
 | File | Purpose |
 |------|---------|
 | `packages.x86_64` | Live ISO package list (~402 packages) |
-| `profiledef.sh` | ISO metadata, compression, boot modes |
+| `profiledef.sh` | ISO metadata, compression, boot modes, build-stamp staging |
 | `pacman.conf` | Repos: cachyos → core → extra → multilib → chaotic-aur → local-aur |
 | `bootstrap_packages` | Minimal build-time packages (`base`, `arch-install-scripts`) |
 | `airootfs/root/customize_airootfs.sh` | Runs inside chroot during build: keyrings, skel dotfiles (incl. end4-pC), qsConfig patch, end-4 `install-deps`, package harvest, uv/font pre-warm |
 | `airootfs/root/.live-pacman.conf` | `/etc/pacman.conf` of the built image (adds `[local-aur]` = `file:///opt/localrepo`) |
-| `airootfs/usr/local/bin/alvin-install` | Installer: partitions, pacstrap, user, end-4 dotfiles (`--skip-alldeps`), boot |
+| `airootfs/usr/local/bin/alvin-install` | Installer: partitions, pacstrap, LUKS (systemd initramfs **or** experimental unl0kr + optional TPM2 unlock), user, git identity + GitHub SSH keys, login manager (none/greetd/sddm/gdm) + autologin, end-4 dotfiles (`--skip-alldeps`), build-stamp motd, boot |
 | `localrepo/build-end4-deps.sh` | Non-interactive AUR builds for end-4 dependencies |
 | `localrepo/update.sh` | Regenerates localrepo DB, syncs names to packages.x86_64, syncs `airootfs/opt/localrepo/` |
 
@@ -72,3 +72,4 @@ install them into the target without the network.
 - End-4 metapackages are built from `localrepo/end4-pkgbuilds/` (quickshell-git, bibata-modern-classic-bin, microtex-git).
 - `packages.x86_64` is sorted alphabetically. Keep it sorted when adding/removing entries.
 - `airootfs/opt/localrepo/` is a build artifact (gitignored) — never commit it.
+- **Build stamp flow**: `profiledef.sh` (sourced by mkarchiso) stages the gitignored `airootfs/root/.iso-build-stamp` when a `.git` dir exists **or** `CI`/`GITEA_ACTIONS` is set — line reads `AlvinArch build <date> | commit <date> | <4-char hash>` (falls back to `commit unknown` if `git -c safe.directory` can't read the repo; without `.git`/CI no file is staged). `customize_airootfs.sh` installs it as `/etc/alvin-build-stamp` on the live medium, and `alvin-install`'s `install_motd` copies the live `/etc/motd` banner to the target and appends the stamp. If the medium has no stamp, the installed system gets no motd from us.