iso: audit-sweep UID, bakery update, lockfile, welcome, autostart

Resolve MAIN_USER after deleting liveuser so Snapper and skel target the
installed account. Wrap bakery update with sudo -n/pkexec for /usr/local.
Pin bakery and bread-theme 0.7.4; require bread-emit and bread-module-host.
Make Calamares internet check non-blocking against breadway.dev. Autostart
breadlock listen. Smoke avahi-daemon.socket to match post-install.

iso/airootfs/etc/calamares/modules/welcome.conf

@@ -3,9 +3,19 @@ showSupportUrl: false
 showKnownIssuesUrl: false
 showReleaseNotesUrl: false
 
+# 3.4.2 schema: `check` is shown; only `required` blocks Next. Internet is
+# informational so offline installs proceed. Do not probe archlinux.org.
 requirements:
   requiredStorage: 20
   requiredRam: 2.0
-  checkInternet: true
-  checkPower: true
-  internetCheckUrl: "https://archlinux.org"
+  internetCheckUrl: "https://breadway.dev"
+  check:
+    - storage
+    - ram
+    - power
+    - internet
+    - root
+  required:
+    - storage
+    - ram
+    - root

iso/airootfs/etc/calamares/post-install.sh

@@ -8,8 +8,6 @@
 # Best-effort: do NOT use `set -e`; a single failure here must not abort the rest.
 set -uo pipefail
 
-MAIN_USER="$(getent passwd 1000 | cut -d: -f1 || true)"
-
 # Whether Calamares encrypted the root partition (LUKS) — checked once here,
 # used below to conditionally wire mkinitcpio's encrypt hook and GRUB's
 # cryptodisk support. `lsblk TYPE` reports "crypt" for a cryptsetup-opened
@@ -33,6 +31,14 @@ rm -f /usr/local/bin/bos-live-setup /usr/local/bin/bos-launch-calamares
 rm -f /etc/sudoers.d/99-bos-live
 userdel -r liveuser 2>/dev/null || true
 
+# Live ISO creates liveuser as UID 1000; Calamares then creates the real
+# account as 1001. Capture AFTER userdel so Snapper ALLOW_USERS and skel
+# copy the installed user, not the deleted live account.
+MAIN_USER="$(getent passwd 1000 | cut -d: -f1 || true)"
+if [[ -z "$MAIN_USER" || "$MAIN_USER" == "liveuser" ]]; then
+    MAIN_USER="$(getent passwd | awk -F: '$3 >= 1000 && $3 < 60000 && $1 != "liveuser" { print $1; exit }')"
+fi
+
 # unpackfs copies the entire live squashfs onto the target. Remove live-only
 # packages (Calamares + archiso boot chain + memtest/EFI-shell payloads) so
 # they do not stay on disk forever. pacman -Rs (not -Rns) keeps /etc configs