Ship yay, wire up LUKS disk encryption, self-signed Secure Boot, release signing

yay (yay-bin, AUR-only like calamares/bibata) republished to [breadway] via
the same PKGBUILD + Forgejo workflow pattern, so users can reach the wider
AUR beyond bakery's bread ecosystem.

Disk encryption: Calamares' partition module already has LUKS support
enabled by default, but the checkbox led nowhere — no cryptsetup on the
live/target image, no mkinitcpio encrypt hook, no GRUB cryptodisk wiring.
An encrypted install would partition fine and then never boot. Added
cryptsetup, pinned luksGeneration to luks1 (GRUB doesn't support LUKS2 +
Argon2id), and post-install.sh now detects an encrypted root (lsblk TYPE
== crypt) and conditionally adds the encrypt hook + GRUB_ENABLE_CRYPTODISK +
--modules="cryptodisk luks luks2" on both grub-install passes. No effect on
a normal unencrypted install.

Secure Boot: self-signed via sbctl (shipped in packages.x86_64). BOS can't
ship a Microsoft-signed shim without going through Microsoft's own paid
UEFI CA process, so post-install.sh enrolls BOS's own keys automatically
only when the firmware is already in Setup Mode (sbctl status --json),
signs the kernel/bootloader, and leaves it alone otherwise — sbctl's own
pacman hook re-signs on every future kernel/GRUB update, no further
wiring needed.

Release signing: generated a dedicated Ed25519 "BOS Release Signing" key
(not reused from anything else), stored as the GPG_PRIVATE_KEY Forgejo
Actions secret. release-iso.yml now generates SHA256SUMS and a detached
SHA256SUMS.asc signature alongside every ISO upload; public key committed
at KEYS.asc with verification instructions in the README.

README updated: fixed a stale "greetd + tuigreet" line (breadgreet since
round 3), documented yay/encryption/secure-boot/verification.

README.md

@@ -20,17 +20,23 @@ wiring up dotfiles, no per-tool bakery installs.
 - **bos-settings**: a GTK4 control panel that configures every bread\* app's
   config from a GUI (non-destructively), plus snapshot rollback and bakery
   updates. See below.
-- **Login**: greetd + tuigreet → Hyprland session.
+- **Login**: greetd + breadgreet (bread-ecosystem's own greeter, under `cage`)
+  → Hyprland session.
 - **Boot splash**: Plymouth `bos` theme (logo + spinner, black background).
 - **Theming**: global dark across GTK3 (Adwaita-dark), GTK4/libadwaita
   (`color-scheme: prefer-dark`), and Qt (qt5ct/qt6ct Fusion dark); Papirus-Dark
   icons; Bibata cursor.
 - **Apps**: kitty, nautilus (+ gvfs), Zen browser, VLC, loupe, gnome-text-editor,
   gnome-calculator, file-roller, with file associations wired in `mimeapps.list`.
+  `yay` ships for AUR access beyond bakery's bread ecosystem + `[breadway]`.
 - **Hardware**: pipewire audio, NetworkManager, BlueZ + blueman, CUPS printing
   with avahi mDNS discovery, TLP power management, fwupd firmware updates.
 - **Resilience**: btrfs + snapper + snap-pac + grub-btrfs snapshots on every
   pacman transaction; zram swap; ufw firewall (deny-incoming, mDNS allowed).
+- **Security**: full-disk encryption (LUKS, via Calamares' built-in support —
+  cryptsetup + the matching mkinitcpio/GRUB wiring ship so an encrypted
+  install actually boots) and self-signed Secure Boot (via `sbctl`, enrolled
+  automatically at install time when the firmware is in Setup Mode).
 
 ## Repo layout
 
@@ -73,11 +79,30 @@ to the Tailscale-reachable Forgejo registry for the build.
 
 ### Why some packages are in-house
 
-`calamares`, `zen-browser-bin`, and `bibata-cursor-theme` are AUR-only. BOS
-keeps a PKGBUILD for each under `packaging/` and republishes the built package
-to the `[breadway]` repo via a Forgejo Actions workflow (built on the hestia
-self-hosted runner, published with a scoped registry token). `bos-settings`
-itself publishes the same way on a `v*` tag.
+`calamares`, `zen-browser-bin`, `bibata-cursor-theme`, and `yay-bin` are
+AUR-only. BOS keeps a PKGBUILD for each under `packaging/` and republishes the
+built package to the `[breadway]` repo via a Forgejo Actions workflow (built
+on the hestia self-hosted runner, published with a scoped registry token).
+`bos-settings` itself publishes the same way on a `v*` tag.
+
+### Verifying a release
+
+Every tagged release ISO on the [Forgejo releases
+page](https://git.breadway.dev/Breadway/bos/releases) ships alongside a
+`SHA256SUMS` file and a detached signature `SHA256SUMS.asc`, signed by a
+dedicated release-signing key (not reused from anything else):
+
+```
+5620 3B86 A110 695A E7F3  1093 4AF3 323D 678E B5E2
+```
+
+The public half is committed at [`KEYS.asc`](KEYS.asc). To verify a download:
+
+```sh
+gpg --import KEYS.asc
+gpg --verify SHA256SUMS.asc SHA256SUMS
+sha256sum -c SHA256SUMS
+```
 
 ## Testing in a VM
 
@@ -166,9 +191,19 @@ cheatsheet in-session; first boot shows a short welcome (once).
   `virtio-vga-gl` + `-display gtk,gl=on` (virgl); plain software rendering is
   noticeably laggy.
 - **Wayland-first**: X11-only apps run through XWayland; a few may misbehave.
-- **Secure Boot**: not configured. Boot with Secure Boot disabled, or enroll
-  your own keys. The installer writes both an NVRAM entry and the removable
-  `EFI/BOOT/BOOTX64.EFI` fallback.
+- **Secure Boot**: self-signed only, via `sbctl` — BOS can't ship a
+  Microsoft-signed shim (that needs going through Microsoft's own paid UEFI
+  CA process). Post-install enrolls BOS's own keys automatically, but only
+  when the firmware is already in Setup Mode (no vendor keys installed yet);
+  otherwise it's skipped and you can run
+  `sudo sbctl enroll-keys --microsoft && sudo sbctl sign-all -g` yourself
+  later (after clearing your firmware's existing keys, if any). The installer
+  writes both an NVRAM entry and the removable `EFI/BOOT/BOOTX64.EFI` fallback
+  either way.
+- **Disk encryption**: full-disk LUKS is available on the installer's "Erase
+  disk" page (Calamares' own checkbox) and on manually-created partitions —
+  BOS ships the matching `cryptsetup`/mkinitcpio/GRUB wiring so an encrypted
+  install actually boots (LUKS1, since GRUB doesn't support LUKS2 + Argon2id).
 - **Snapshots assume btrfs**: the snapper/grub-btrfs tooling expects the default
   btrfs subvolume layout the installer creates.