iso: add bos-rescue, first-boot probe, optional Calamares refresh

Live-ISO bos-rescue finds the installed btrfs @ and ESP, then offers
arch-chroot and/or the same GRUB NVRAM + --removable sequence as
post-install.sh. Recovery is grub-btrfs or this reinstall — GRUB pins
rootflags=subvol=@.

bos-first-boot runs once after the first graphical login: NVIDIA offer
file + notify (no driver install), VM-without-GL notify, HiDPI hint
file (never rewrites monitors.json).

Re-enable the Calamares packages module as a refresh-only step with
skip_if_no_internet and ignore_update_db_error so offline installs
cannot abort on pacman -Sy.

iso/airootfs/etc/calamares/modules/packages.conf

@@ -1,10 +1,24 @@
 ---
+# Optional online pacman refresh. The previous packages step used
+# update_db:true with no skip/ignore, so `pacman -Sy` aborted offline
+# installs (the case bos-netcheck exists for). skip_if_no_internet
+# skips the whole module when Calamares sees no network;
+# ignore_update_db_error keeps a flake-mirror -Sy from failing the
+# install. update_system stays false — this is not a -Syu.
+#
+# try_install is empty: pipewire-pulse / pipewire-alsa already come
+# from packages.x86_64 via unpackfs. No extra packages (and no
+# nvidia) are pulled here.
 backend: pacman
 
-options:
-  - update_db: true
+skip_if_no_internet: true
+update_db: true
+ignore_update_db_error: true
+update_system: false
 
-operations:
-  - try_install:
-    - pipewire-pulse
-    - pipewire-alsa
+pacman:
+  num_retries: 1
+  disable_download_timeout: false
+  needed_only: true
+
+operations: []

iso/airootfs/etc/calamares/settings.conf

@@ -35,12 +35,6 @@ sequence:
     - users
     - networkcfg
     - hwclock
-    # packages module removed: it set update_db:true with no
-    # skip_if_no_internet/ignore_update_db_error, so an offline install (the
-    # exact case bos-welcome's nmtui step exists for) aborted here with a
-    # fatal pacman -Sy failure. Its only try_install packages (pipewire-pulse,
-    # pipewire-alsa) are already in packages.x86_64 and installed by
-    # unpackfs, so the step did nothing useful even when it succeeded.
     # archiso strips the kernel from the squashfs; stage it, drop the archiso
     # initramfs config, and write a stock mkinitcpio preset before initcpio runs.
     - shellprocess@kernel
@@ -57,6 +51,12 @@ sequence:
     # BOS finalization: GRUB install + cleanup + snapper + services + dotfiles.
     # All fast, and runs after initcpio so /boot has the kernel + initramfs.
     - shellprocess
+    # Optional online pacman -Sy. After post-install so the target keyring
+    # exists. skip_if_no_internet + ignore_update_db_error: an offline
+    # install (or a flake-mirror -Sy) must not abort. operations is empty —
+    # pipewire-pulse/alsa already come from unpackfs; nothing extra (and
+    # no nvidia) is installed here.
+    - packages
     - umount
   - show:
     - finished