Make BOS a complete, bootable, themed desktop OS

Install/boot reliability:
- Use native Calamares initcpiocfg/initcpio + explicit grub-install (nvram +
  --removable) in post-install; drop the flaky native bootloader/grubcfg modules.
- mount.conf: bind /proc /sys /dev (devtmpfs) /run + efivars into the chroot.
- bos-copy-kernel: stage kernel + write a stock mkinitcpio preset (replace the
  archiso preset). Per-service systemctl enable (fixes NetworkManager et al.
  silently not enabling due to the all-or-nothing grub-btrfs.path name).

System completeness:
- greetd + tuigreet graphical login; installed pacman.conf + working mirrorlist;
  base CLI tools (nano, micro, vim, htop, …); amd/intel-ucode; tlp + hypridle
  power management; systemd-timesyncd, fstrim.timer; wpa_supplicant wifi; Zen
  browser (republished to the [Breadway] repo).

Desktop + theming:
- Native Lua Hyprland config (hyprland.lua) with curated standard binds; kitty
  (blur) replaces foot; awww wallpaper + pywal palette (tamed to a black base
  with warm accents); GTK dark mode.
- Plymouth boot splash (bos theme: logo + spinner + status) via plymouthcfg.
- Varela Round font; Calamares bread-palette sidebar (logo/black-region polish
  still pending).

iso/airootfs/etc/pacman.conf

@@ -0,0 +1,44 @@
+#
+# BOS pacman.conf — used during ISO build and installed to the target system.
+# Based on the standard Arch Linux pacman.conf.
+#
+
+[options]
+HoldPkg     = pacman glibc
+Architecture = auto
+CheckSpace
+ParallelDownloads = 5
+
+Color
+VerbosePkgLists
+ILoveCandy
+
+SigLevel    = Required DatabaseOptional
+LocalFileSigLevel = Optional
+
+[core]
+Include = /etc/pacman.d/mirrorlist
+
+[extra]
+Include = /etc/pacman.d/mirrorlist
+
+[multilib]
+Include = /etc/pacman.d/mirrorlist
+
+# -----------------------------------------------------------------------
+# Breadway custom repo — provides: bakery and the bread ecosystem packages
+# (bread, breadbar, breadbox, breadcrumbs, breadpad, bos-settings).
+# (calamares comes from the official extra repo, not here.)
+#
+# Packages are published to the Forgejo Arch registry (group "os") by the
+# .forgejo/workflows/package.yml workflow in each repo, on tag push.
+#
+# Forgejo signs the repo db with a key pacman can't look up, so TrustAll
+# fails. SigLevel = Never skips verification (acceptable for this private
+# repo over TLS). TODO: import Forgejo's signing key + SigLevel = Required.
+# -----------------------------------------------------------------------
+# The section name must match Forgejo's served db filename
+# ({owner}.{group}.{domain}.db) — pacman fetches "<section>.db" from Server.
+[Breadway.os.git.breadway.dev]
+SigLevel = Never
+Server = https://git.breadway.dev/api/packages/Breadway/arch/os/$arch