Fix bos-settings compile errors and use REGISTRY_TOKEN for publishing

bos-settings was scaffolded but never compiled. Fixes:
- main.rs: import gtk4::prelude (connect_activate/run)
- window.rs: disambiguate WidgetExt::display(); drop unused GBox import
- hyprland.rs: Label has no set_monospace -> use the monospace CSS class
- theme.rs: drop unused prelude import

Also switch package.yml to secrets.REGISTRY_TOKEN (scoped write:package),
since the auto Actions token is not authorized for the owner registry.

.claude/agent-memory/prod-readiness-auditor/MEMORY.md

@@ -0,0 +1,3 @@
+# Memory Index
+
+- [BOS Project Patterns](project-bos-patterns.md) — recurring hotspots and architectural constraints specific to the BOS repo

.claude/agent-memory/prod-readiness-auditor/project-bos-patterns.md

@@ -0,0 +1,30 @@
+---
+name: project-bos-patterns
+description: Recurring patterns and hotspots to watch in the BOS repo across audits
+metadata:
+  type: project
+---
+
+BOS is a rolling Arch Linux OS project combining an archiso installer profile, Calamares configuration, default dotfiles, and a GTK4 Rust settings app (bos-settings).
+
+**Why:** This is a scaffold-originated repo; the initial code was written in one pass and has several recurring anti-patterns worth watching on future audits.
+
+**How to apply:** Check these areas first on any future audit pass.
+
+## Recurring hotspots
+
+- **config_dir() + /home/user fallback**: Multiple views (breadbar, hyprland, packages) originally inlined `std::env::var("HOME").unwrap_or_else(|_| "/home/user".to_string())` instead of calling `config::config_dir()`. Watch for new views duplicating this.
+- **branding.desc YAML**: The `sidebarTextHighlight` key had no space after the colon, causing a hard YAML parse error. Future edits to this file should be checked with `python3 -c "import yaml; yaml.safe_load(open('branding.desc'))"`.
+- **Branding images missing**: `logo.png` and `languages.png` are referenced in branding.desc but do not exist in the repo. These must be created before any ISO build attempt.
+- **state.rs is dead code**: The file exists at `bos-settings/src/state.rs` but is not declared as `mod state` in `main.rs`. It is silently ignored by cargo. Either wire it in or delete it.
+- **pacman.conf TODO**: `[breadway]` repo URL in `iso/pacman.conf` has a TODO comment — must be a live repo before the ISO can be built.
+- **eprintln! in production paths**: packages.rs had `eprintln!("bakery update failed: {e}")` inside a GTK callback. GTK apps don't have useful stderr at runtime. Convert to silent handling or surface errors through the UI.
+- **can-you-begin-a-composed-beacon.md**: AI-generated random filename for the project plan doc. Should be renamed to PLAN.md before the repo is shared publicly.
+- **skel == dotfiles duplication**: `iso/airootfs/etc/skel/.config/` and `dotfiles/` are byte-for-byte identical. This is by design for now, but risks divergence. The plan calls for post-install.sh to copy skel into user home — skel is the authoritative copy; dotfiles/ is redundant scaffolding. Flag in future audits if they diverge.
+
+## Key architectural constraints
+
+- Calamares shellprocess runs inside chroot (`dont-chroot: false`). `systemctl enable` works, `systemctl start` does not.
+- `MAIN_USER` is derived via `getent passwd 1000` — safe only after Calamares `users` step which precedes `shellprocess` in settings.conf.
+- The polkit rule grants wheel-group members passwordless `snapper rollback` via pkexec — intentional per design.
+- The live session autologs as root (not a "liveuser") — standard archiso releng behavior, not a bug.

.forgejo/workflows/package.yml

@@ -14,7 +14,7 @@ jobs:
       # actions require. Everything runs as shell steps and clones manually.
       - name: Build and publish
         env:
-          PUBLISH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PUBLISH_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
         run: |
           set -euo pipefail
           VERSION="${GITHUB_REF_NAME#v}"

bos-settings/src/main.rs

@@ -2,6 +2,8 @@ mod config;
 mod theme;
 mod ui;
 
+use gtk4::prelude::*;
+
 fn main() {
     let app = gtk4::Application::builder()
         .application_id("com.breadway.bos-settings")

bos-settings/src/theme.rs

@@ -1,4 +1,3 @@
-use gtk4::prelude::*;
 use gtk4::CssProvider;
 
 const CSS: &str = r#"

bos-settings/src/ui/views/hyprland.rs

@@ -50,7 +50,7 @@ pub fn build() -> GBox {
         for mon in &monitors {
             let lbl = Label::new(Some(mon));
             lbl.set_xalign(0.0);
-            lbl.set_monospace(true);
+            lbl.add_css_class("monospace");
             vbox.append(&lbl);
         }
     }

bos-settings/src/ui/window.rs

@@ -1,5 +1,5 @@
 use gtk4::prelude::*;
-use gtk4::{Application, ApplicationWindow, Box as GBox, Orientation, Paned, Stack};
+use gtk4::{Application, ApplicationWindow, Orientation, Paned, Stack};
 
 use super::sidebar;
 use super::views;
@@ -12,7 +12,7 @@ pub fn build_ui(app: &Application) {
         .default_height(640)
         .build();
 
-    crate::theme::load(&window.display());
+    crate::theme::load(&WidgetExt::display(&window));
 
     let hpaned = Paned::new(Orientation::Horizontal);
     hpaned.set_position(190);