1.0 polish: os-release, snapper pre, lockfile pins, listen, docs

Point os-release at the bos repo and issues; drop Arch privacy terms.
Take a best-effort snapper pre snapshot before pacman and bakery.
Pin current stable bakery versions so CI fetches the same bits per commit.
Autostart breadpaper/breadshot listen behind command -v.
Document signed-repo setup and Mesa/NVIDIA/grub-btrfs recovery.

iso/airootfs/usr/local/bin/bos-update

@@ -19,6 +19,24 @@ set -uo pipefail
 
 bold() { printf '\033[1m%s\033[0m\n' "$1"; }
 
+# Timed snapper pre snapshot before either channel. snap-pac already
+# snapshots root around pacman; bakery writes ~/.local/bin ($HOME / @home),
+# which is outside that root snapshot. This extra snapshot is still
+# best-effort and covers bakery $HOME updates as well as possible — a
+# home config if the installer created one, otherwise the root timeline
+# around the whole update. Never fail the update if snapper is missing
+# or the create errors.
+if command -v snapper >/dev/null; then
+    if snapper -c home list >/dev/null 2>&1; then
+        snapper -c home create -t pre -c number \
+            -d "bos-update (pre bakery)" \
+            || echo "WARN: snapper home pre snapshot failed"
+    fi
+    snapper -c root create -t pre -c number \
+        -d "bos-update (pre bakery)" \
+        || echo "WARN: snapper pre snapshot failed"
+fi
+
 bold "==> System packages (pacman -Syu)"
 if command -v pacman >/dev/null; then
     sudo pacman -Syu || echo "WARN: pacman update failed"