iso: add bos-rescue, first-boot probe, optional Calamares refresh

Live-ISO bos-rescue finds the installed btrfs @ and ESP, then offers
arch-chroot and/or the same GRUB NVRAM + --removable sequence as
post-install.sh. Recovery is grub-btrfs or this reinstall — GRUB pins
rootflags=subvol=@.

bos-first-boot runs once after the first graphical login: NVIDIA offer
file + notify (no driver install), VM-without-GL notify, HiDPI hint
file (never rewrites monitors.json).

Re-enable the Calamares packages module as a refresh-only step with
skip_if_no_internet and ignore_update_db_error so offline installs
cannot abort on pacman -Sy.

iso/airootfs/etc/calamares/modules/packages.conf

@@ -1,10 +1,24 @@
 ---
+# Optional online pacman refresh. The previous packages step used
+# update_db:true with no skip/ignore, so `pacman -Sy` aborted offline
+# installs (the case bos-netcheck exists for). skip_if_no_internet
+# skips the whole module when Calamares sees no network;
+# ignore_update_db_error keeps a flake-mirror -Sy from failing the
+# install. update_system stays false — this is not a -Syu.
+#
+# try_install is empty: pipewire-pulse / pipewire-alsa already come
+# from packages.x86_64 via unpackfs. No extra packages (and no
+# nvidia) are pulled here.
 backend: pacman
 
-options:
-  - update_db: true
+skip_if_no_internet: true
+update_db: true
+ignore_update_db_error: true
+update_system: false
 
-operations:
-  - try_install:
-    - pipewire-pulse
-    - pipewire-alsa
+pacman:
+  num_retries: 1
+  disable_download_timeout: false
+  needed_only: true
+
+operations: []

iso/airootfs/etc/calamares/settings.conf

@@ -35,12 +35,6 @@ sequence:
     - users
     - networkcfg
     - hwclock
-    # packages module removed: it set update_db:true with no
-    # skip_if_no_internet/ignore_update_db_error, so an offline install (the
-    # exact case bos-welcome's nmtui step exists for) aborted here with a
-    # fatal pacman -Sy failure. Its only try_install packages (pipewire-pulse,
-    # pipewire-alsa) are already in packages.x86_64 and installed by
-    # unpackfs, so the step did nothing useful even when it succeeded.
     # archiso strips the kernel from the squashfs; stage it, drop the archiso
     # initramfs config, and write a stock mkinitcpio preset before initcpio runs.
     - shellprocess@kernel
@@ -57,6 +51,12 @@ sequence:
     # BOS finalization: GRUB install + cleanup + snapper + services + dotfiles.
     # All fast, and runs after initcpio so /boot has the kernel + initramfs.
     - shellprocess
+    # Optional online pacman -Sy. After post-install so the target keyring
+    # exists. skip_if_no_internet + ignore_update_db_error: an offline
+    # install (or a flake-mirror -Sy) must not abort. operations is empty —
+    # pipewire-pulse/alsa already come from unpackfs; nothing extra (and
+    # no nvidia) is installed here.
+    - packages
     - umount
   - show:
     - finished

iso/airootfs/etc/skel/.config/hypr/autostart.json

@@ -3,6 +3,7 @@
     { "command": "breadbar", "label": "Bar (breadbar)", "enabled": true },
     { "command": "hypridle", "label": "Idle / lock daemon (hypridle)", "enabled": true },
     { "command": "bos-netcheck", "label": "Network connectivity check", "enabled": true },
+    { "command": "bash -c 'command -v bos-first-boot >/dev/null && exec bos-first-boot'", "label": "First-boot hardware probe", "enabled": true },
     { "command": "breadhelp --autostart", "label": "BOS Help (first-run onboarding)", "enabled": true },
     { "command": "bash -c 'command -v breadpaper >/dev/null && exec breadpaper listen'", "label": "Wallpaper command bus (breadpaper listen)", "enabled": true },
     { "command": "bash -c 'command -v breadshot >/dev/null && exec breadshot listen'", "label": "Screenshot command bus (breadshot listen)", "enabled": true },

iso/airootfs/etc/skel/.config/hypr/hyprland.lua

@@ -174,6 +174,7 @@ hl.on("hyprland.start", function()
             "breadbar",
             "hypridle",
             "bos-netcheck",
+            "bash -c 'command -v bos-first-boot >/dev/null && exec bos-first-boot'",
             "breadhelp --autostart",
             "bash -c 'command -v breadpaper >/dev/null && exec breadpaper listen'",
             "bash -c 'command -v breadshot >/dev/null && exec breadshot listen'",

iso/airootfs/etc/skel/.config/hypr/scripts/system/autostart.lua

@@ -18,6 +18,7 @@ local DEFAULT_EXTRA = {
     { command = "breadbar", enabled = true },
     { command = "hypridle", enabled = true },
     { command = "bos-netcheck", enabled = true },
+    { command = "bash -c 'command -v bos-first-boot >/dev/null && exec bos-first-boot'", enabled = true },
     { command = "breadhelp --autostart", enabled = true },
     { command = "bash -c 'command -v breadpaper >/dev/null && exec breadpaper listen'", enabled = true },
     { command = "bash -c 'command -v breadshot >/dev/null && exec breadshot listen'", enabled = true },