iso: audit-sweep UID, bakery update, lockfile, welcome, autostart

Resolve MAIN_USER after deleting liveuser so Snapper and skel target the
installed account. Wrap bakery update with sudo -n/pkexec for /usr/local.
Pin bakery and bread-theme 0.7.4; require bread-emit and bread-module-host.
Make Calamares internet check non-blocking against breadway.dev. Autostart
breadlock listen. Smoke avahi-daemon.socket to match post-install.

iso/bread-lockfile.toml

@@ -3,8 +3,8 @@
 # build-local.sh and CI (scripts/ci-stage-bakery.py) read this file. A missing
 # *required* binary fails the bake: a hollow ISO is worse than a failed build.
 # optional_bins are baked when the verified stable index publishes them, and
-# skipped with a warning when it does not (today: bread 0.8.0 has no
-# bread-emit / bread-module-host).
+# skipped with a warning when it does not. bread 0.8.0 ships bread-emit and
+# bread-module-host, so those are required_bins.
 #
 # A flat `bins` list is still accepted and treated as required_bins.
 #
@@ -23,6 +23,8 @@ required_bins = [
   "bakery",
   "bread",
   "breadd",
+  "bread-emit",
+  "bread-module-host",
   "breadman",
   "breadbar",
   "breadbox",
@@ -41,19 +43,13 @@ required_bins = [
   "breadhelp",
 ]
 
-# Bake if the verified index publishes them; do not fail the ISO if absent.
-optional_bins = [
-  "bread-emit",
-  "bread-module-host",
-]
-
 # Package name → version. Must exist at dl.breadway.dev/<pkg>/<ver>/ and
 # should match the signed index so CI can verify sha256.
 # [[pin]] { package, version } is accepted as well and merged (conflict = bake error).
 [versions]
-bakery = "0.7.3"
+bakery = "0.7.4"
 bread = "0.8.0"
-bread-theme = "0.7.3"
+bread-theme = "0.7.4"
 breadbar = "0.3.2"
 breadbox = "0.3.2"
 breadcrumbs = "2.1.8"