1.0 polish: os-release, snapper pre, lockfile pins, listen, docs

Point os-release at the bos repo and issues; drop Arch privacy terms.
Take a best-effort snapper pre snapshot before pacman and bakery.
Pin current stable bakery versions so CI fetches the same bits per commit.
Autostart breadpaper/breadshot listen behind command -v.
Document signed-repo setup and Mesa/NVIDIA/grub-btrfs recovery.

iso/airootfs/etc/os-release

@@ -5,7 +5,7 @@ ID_LIKE=arch
 BUILD_ID=rolling
 ANSI_COLOR="38;2;23;147;209"
 HOME_URL="https://breadway.dev"
-DOCUMENTATION_URL="https://wiki.archlinux.org/"
-SUPPORT_URL="https://bbs.archlinux.org/"
+DOCUMENTATION_URL="https://git.breadway.dev/Breadway/bos"
+SUPPORT_URL="https://git.breadway.dev/Breadway/bos/issues"
 BUG_REPORT_URL="https://git.breadway.dev/Breadway/bos/issues"
-PRIVACY_POLICY_URL="https://terms.archlinux.org/docs/privacy-policy/"
+PRIVACY_POLICY_URL="https://breadway.dev"

iso/airootfs/etc/skel/.config/hypr/autostart.json

@@ -3,6 +3,8 @@
     { "command": "breadbar", "label": "Bar (breadbar)", "enabled": true },
     { "command": "hypridle", "label": "Idle / lock daemon (hypridle)", "enabled": true },
     { "command": "bos-netcheck", "label": "Network connectivity check", "enabled": true },
-    { "command": "breadhelp --autostart", "label": "BOS Help (first-run onboarding)", "enabled": true }
+    { "command": "breadhelp --autostart", "label": "BOS Help (first-run onboarding)", "enabled": true },
+    { "command": "bash -c 'command -v breadpaper >/dev/null && exec breadpaper listen'", "label": "Wallpaper command bus (breadpaper listen)", "enabled": true },
+    { "command": "bash -c 'command -v breadshot >/dev/null && exec breadshot listen'", "label": "Screenshot command bus (breadshot listen)", "enabled": true }
   ]
 }

iso/airootfs/etc/skel/.config/hypr/hyprland.lua

@@ -106,8 +106,10 @@ hl.gesture({
 -- daemon, breadd's Wayland-env fix, breadclipd) stays hardcoded here — it's
 -- timing/order-sensitive infrastructure, not something a settings UI should
 -- expose for a user to disable or reorder. The extra, genuinely toggleable
--- apps (breadbar, hypridle, bos-netcheck, breadhelp) come from
--- autostart.json via scripts/system/autostart.lua, appended after.
+-- apps (breadbar, hypridle, bos-netcheck, breadhelp, breadpaper/breadshot
+-- listen) come from autostart.json via scripts/system/autostart.lua,
+-- appended after. listen is wrapped with `command -v` so a missing
+-- binary does not brick login (Hyprland exec is already fire-and-forget).
 -- (bos-live-setup appends the live-installer launch below this on the ISO.)
 -- ---------------------------------------------------------------------------
 hl.on("hyprland.start", function()
@@ -168,7 +170,14 @@ hl.on("hyprland.start", function()
         -- autostart.json/its loader broke — fall back to the same apps BOS
         -- has always started, so a bad JSON edit degrades to "normal
         -- desktop" rather than "no bar, no idle lock, no onboarding".
-        extra = { "breadbar", "hypridle", "bos-netcheck", "breadhelp --autostart" }
+        extra = {
+            "breadbar",
+            "hypridle",
+            "bos-netcheck",
+            "breadhelp --autostart",
+            "bash -c 'command -v breadpaper >/dev/null && exec breadpaper listen'",
+            "bash -c 'command -v breadshot >/dev/null && exec breadshot listen'",
+        }
     end
     for _, cmd in ipairs(extra) do
         hl.dispatch(hl.dsp.exec_cmd(cmd))

iso/airootfs/etc/skel/.config/hypr/scripts/system/autostart.lua

@@ -12,11 +12,15 @@
 -- because the valid result happens to be empty.
 local json = dofile(os.getenv("HOME") .. "/.config/hypr/scripts/lib/json.lua")
 
+-- breadpaper/breadshot `listen` is wrapped so a missing binary (stable
+-- does not ship the command-bus verb yet) cannot take down the session.
 local DEFAULT_EXTRA = {
     { command = "breadbar", enabled = true },
     { command = "hypridle", enabled = true },
     { command = "bos-netcheck", enabled = true },
     { command = "breadhelp --autostart", enabled = true },
+    { command = "bash -c 'command -v breadpaper >/dev/null && exec breadpaper listen'", enabled = true },
+    { command = "bash -c 'command -v breadshot >/dev/null && exec breadshot listen'", enabled = true },
 }
 
 return function()

iso/airootfs/usr/local/bin/bos-update

@@ -19,6 +19,24 @@ set -uo pipefail
 
 bold() { printf '\033[1m%s\033[0m\n' "$1"; }
 
+# Timed snapper pre snapshot before either channel. snap-pac already
+# snapshots root around pacman; bakery writes ~/.local/bin ($HOME / @home),
+# which is outside that root snapshot. This extra snapshot is still
+# best-effort and covers bakery $HOME updates as well as possible — a
+# home config if the installer created one, otherwise the root timeline
+# around the whole update. Never fail the update if snapper is missing
+# or the create errors.
+if command -v snapper >/dev/null; then
+    if snapper -c home list >/dev/null 2>&1; then
+        snapper -c home create -t pre -c number \
+            -d "bos-update (pre bakery)" \
+            || echo "WARN: snapper home pre snapshot failed"
+    fi
+    snapper -c root create -t pre -c number \
+        -d "bos-update (pre bakery)" \
+        || echo "WARN: snapper pre snapshot failed"
+fi
+
 bold "==> System packages (pacman -Syu)"
 if command -v pacman >/dev/null; then
     sudo pacman -Syu || echo "WARN: pacman update failed"