feat(installer): build-stamp motd, LUKS mode A/B, TPM2, unl0kr, login managers

- profiledef.sh stages airootfs/root/.iso-build-stamp (git/CI gated, falls
  back to 'commit unknown'); customize_airootfs.sh installs it as
  /etc/alvin-build-stamp; install_motd appends it to the target /etc/motd
- alvin-install: skippable git/GitHub screens with ssh-import-id import
  (yay build + python-distro, curl .keys fallback), LUKS Mode A (systemd
  sd-encrypt + rd.luks.name) vs Mode B (unl0kr + cryptdevice), TPM2
  enrollment via $PASSWORD with rd.luks.options activation, unl0kr
  build/verify with Mode-A fallback, login manager none/greetd/sddm/gdm
  (enable DM before disabling getty@tty1), autologin per DM (forced off
  when TPM enrolled), build-stamp motd; includes the existing
  GRUB_DISABLE_BOOTNEXT grub tweak
- review fixes: greetd autologin TOML quoting, .ssh chowned before
  ssh-import-id, builtin-aware initramfs module verification across all
  installed kernels, curl exit-code split (fetch failure vs no keys),
  plain Hyprland on every login path
- add curl to packages.x86_64; document stamp flow and installer in
  AGENTS.md/README.md

.gitignore

@@ -5,3 +5,7 @@ out/
 # In-image copy of localrepo/ — populated by localrepo/update.sh and
 # .gitea/workflows/build-iso.yaml, shipped as /opt/localrepo on the ISO
 airootfs/opt/localrepo/
+
+# Build stamp staged by profiledef.sh at ISO build time (see AGENTS.md);
+# consumed by customize_airootfs.sh, never committed
+airootfs/root/.iso-build-stamp

AGENTS.md

@@ -49,12 +49,12 @@ install them into the target without the network.
 | File | Purpose |
 |------|---------|
 | `packages.x86_64` | Live ISO package list (~402 packages) |
-| `profiledef.sh` | ISO metadata, compression, boot modes |
+| `profiledef.sh` | ISO metadata, compression, boot modes, build-stamp staging |
 | `pacman.conf` | Repos: cachyos → core → extra → multilib → chaotic-aur → local-aur |
 | `bootstrap_packages` | Minimal build-time packages (`base`, `arch-install-scripts`) |
 | `airootfs/root/customize_airootfs.sh` | Runs inside chroot during build: keyrings, skel dotfiles (incl. end4-pC), qsConfig patch, end-4 `install-deps`, package harvest, uv/font pre-warm |
 | `airootfs/root/.live-pacman.conf` | `/etc/pacman.conf` of the built image (adds `[local-aur]` = `file:///opt/localrepo`) |
-| `airootfs/usr/local/bin/alvin-install` | Installer: partitions, pacstrap, user, end-4 dotfiles (`--skip-alldeps`), boot |
+| `airootfs/usr/local/bin/alvin-install` | Installer: partitions, pacstrap, LUKS (systemd initramfs **or** experimental unl0kr + optional TPM2 unlock), user, git identity + GitHub SSH keys, login manager (none/greetd/sddm/gdm) + autologin, end-4 dotfiles (`--skip-alldeps`), build-stamp motd, boot |
 | `localrepo/build-end4-deps.sh` | Non-interactive AUR builds for end-4 dependencies |
 | `localrepo/update.sh` | Regenerates localrepo DB, syncs names to packages.x86_64, syncs `airootfs/opt/localrepo/` |
 
@@ -72,3 +72,4 @@ install them into the target without the network.
 - End-4 metapackages are built from `localrepo/end4-pkgbuilds/` (quickshell-git, bibata-modern-classic-bin, microtex-git).
 - `packages.x86_64` is sorted alphabetically. Keep it sorted when adding/removing entries.
 - `airootfs/opt/localrepo/` is a build artifact (gitignored) — never commit it.
+- **Build stamp flow**: `profiledef.sh` (sourced by mkarchiso) stages the gitignored `airootfs/root/.iso-build-stamp` when a `.git` dir exists **or** `CI`/`GITEA_ACTIONS` is set — line reads `AlvinArch build <date> | commit <date> | <4-char hash>` (falls back to `commit unknown` if `git -c safe.directory` can't read the repo; without `.git`/CI no file is staged). `customize_airootfs.sh` installs it as `/etc/alvin-build-stamp` on the live medium, and `alvin-install`'s `install_motd` copies the live `/etc/motd` banner to the target and appends the stamp. If the medium has no stamp, the installed system gets no motd from us.

README.md

@@ -50,6 +50,7 @@ AlvinArch/
 ### Key Features
 
 - **Hyprland + end-4** — Wayland compositor with illogical-impulse dotfiles (quickshell, bibata cursors, microtex)
+- **Automated installer (`alvin-install`)** — gum TUI: LUKS with systemd initramfs or experimental touchscreen unl0kr, optional TPM2 auto-unlock, GitHub SSH key import, login manager choice (none/greetd/sddm/gdm), autologin, and a build stamp in `/etc/motd`
 - **LazyVim** — Pre-configured Neovim with lazy.nvim and curated plugins
 - **Fish + Zsh + Starship** — Dual shell setup with oh-my-zsh and a cross-shell prompt
 - **Local AUR repo** — Pre-built packages (end-4 deps, wallust, grub-customizer, etc.) that aren't in official repos

airootfs/root/customize_airootfs.sh

@@ -14,6 +14,13 @@ pacman-key --populate archlinux cachyos chaotic
 install -m 0644 /root/.live-pacman.conf /etc/pacman.conf
 rm -f /root/.live-pacman.conf
 
+# Build stamp staged by profiledef.sh (absent for non-git, non-CI builds):
+# keep it where alvin-install looks for it, drop the staging copy.
+if [[ -f /root/.iso-build-stamp ]]; then
+  install -m 0644 /root/.iso-build-stamp /etc/alvin-build-stamp
+  rm -f /root/.iso-build-stamp
+fi
+
 # ============================================================================
 # Pre-install dotfile dependencies into /etc/skel so new users get them
 # instantly on first login (no network required).

packages.x86_64

@@ -46,6 +46,7 @@ cpio
 cronie
 cryptsetup
 cups
+curl
 darkhttpd
 davs2
 dconf-editor

profiledef.sh

@@ -24,3 +24,32 @@ file_permissions=(
   ["/usr/local/bin/Installation_guide"]="0:0:755"
   ["/usr/local/bin/livecd-sound"]="0:0:755"
 )
+
+# ── Build stamp (staged file, never committed) ────────────────────────────────
+# airootfs/root/.iso-build-stamp lands at /root/.iso-build-stamp on the ISO;
+# customize_airootfs.sh installs it as /etc/alvin-build-stamp, and alvin-install
+# appends it to the installed system's /etc/motd. Only stamp builds from a git
+# checkout or CI — a random source-tarball build would record a bogus commit.
+# Sourced by mkarchiso under `set -eu`, hence every expansion is defaulted.
+_stamp_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+_stamp_file="${_stamp_dir}/airootfs/root/.iso-build-stamp"
+rm -f "${_stamp_file}"
+if [[ -e "${_stamp_dir}/.git" || -n "${CI:-}" || -n "${GITEA_ACTIONS:-}" ]]; then
+    _stamp_build="$(date --date="@${SOURCE_DATE_EPOCH:-$(date +%s)}" +%Y-%m-%d)"
+    # git ≥2.46 honours -c safe.directory even when mkarchiso runs as root
+    # over a user-owned checkout; older gits ignore it (protected-config
+    # scope) and fall through to the "unknown" line below instead of failing
+    # the build (`|| true` keeps set -e happy either way).
+    _stamp_commit="$(git -C "${_stamp_dir}" -c safe.directory="${_stamp_dir}" \
+        log -1 --format='%cs|%h' 2>/dev/null || true)"
+    if [[ -n "${_stamp_commit}" && "${_stamp_commit}" == *"|"* ]]; then
+        _stamp_hash="${_stamp_commit##*|}"
+        printf 'AlvinArch build %s | commit %s | %s\n' \
+            "${_stamp_build}" "${_stamp_commit%%|*}" "${_stamp_hash:0:4}" \
+            > "${_stamp_file}"
+    else
+        printf 'AlvinArch build %s | commit unknown\n' \
+            "${_stamp_build}" > "${_stamp_file}"
+    fi
+fi
+unset _stamp_dir _stamp_file _stamp_build _stamp_commit _stamp_hash