ci: install grub on the ISO builder

profiledef.sh uses uefi.grub. mkarchiso checks for grub-install on the
host before building; archiso does not pull grub, so the v0.6.0 bake
aborted after bakery staging.

.forgejo/workflows/release-iso.yml

@@ -41,7 +41,10 @@ jobs:
     steps:
       - name: Install build dependencies
         run: |
-          pacman -Syu --noconfirm archiso curl python git minisign
+          # grub is required by profiledef.sh bootmodes=('uefi.grub'):
+          # mkarchiso validates grub-install on the *builder*, not the image.
+          # archiso pulls syslinux/squashfs-tools/libisoburn; it does not pull grub.
+          pacman -Syu --noconfirm archiso grub curl python git minisign
 
       - name: Determine tag and version
         id: vars

scripts/ci-verify-bake.sh

@@ -42,6 +42,12 @@ PY
 
 echo "== lockfile $LOCKFILE =="
 echo "   ${#REQUIRED_BINS[@]} required, ${#OPTIONAL_BINS[@]} optional"
+echo "== host tools =="
+if command -v grub-install >/dev/null 2>&1; then
+  ok "grub-install (uefi.grub bootmode)"
+else
+  bad "grub-install missing — mkarchiso uefi.grub will abort (install grub on the builder)"
+fi
 echo "== builder home $LAPTOP_HOME =="
 
 check_exec() {