Add rsync and make the installed system bootable/clean

unpackfs runs unsquashfs then rsync to copy the rootfs onto the target;
rsync was missing (error code 127), so add it alongside squashfs-tools.

unpackfs also copies the live filesystem verbatim, so the installed
system would inherit the archiso initramfs hooks (booting into the live
path) plus the live autologin/user/sudoers. Rework post-install.sh to run
in the target chroot as a resilient best-effort script that:
- removes the live autologin drop-in, bos-live-setup service/scripts and
  the liveuser sudoers file, and locks root (sudo model; the live medium
  left root passwordless),
- drops the archiso mkinitcpio config, installs the stock linux.preset and
  regenerates the initramfs, then refreshes grub.cfg,
- keeps the snapper/services/dotfiles setup, with the network-dependent
  bakery install made non-fatal so offline installs still complete.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

iso/packages.x86_64

@@ -14,6 +14,8 @@ mtools
 # squashfs-tools: provides unsquashfs, which Calamares' unpackfs module uses
 # to extract airootfs.sfs onto the target during install.
 squashfs-tools
+# rsync: unpackfs copies the unpacked rootfs onto the target with rsync.
+rsync
 # Live-ISO boot (archiso bootmodes: bios.syslinux + uefi.systemd-boot)
 # mkinitcpio-archiso provides the initramfs hooks that find and mount
 # airootfs.sfs and switch root into it — without it the live ISO drops