fix: run the live X session as an unprivileged user

The workstation ISO failed to start X with:

    (EE) unrecognized option --allow-root

Debian trixie ships Xorg 21.1.x, which removed --allow-root / -allowRoot
entirely — running the X server as root is no longer supported. The live
session now:

- creates a dedicated unprivileged `liveuser` account (in tty, video,
  input, audio groups) in build-live.sh;
- starts Xorg as `liveuser` on vt1 (no -allow-root flag at all);
- grants root display access (xhost +SI:localuser:root);
- still runs the installer itself as root, since deploy-disk.sh needs
  root. xinit is no longer used (and dropped from the package list).

scripts/build-live.sh

@@ -59,10 +59,17 @@ chroot_run "export DEBIAN_FRONTEND=noninteractive
 apt-get update -qq
 apt-get install -y --no-install-recommends \
   live-boot live-config-systemd live-tools \
-  xserver-xorg xinit x11-xserver-utils openbox \
+  xserver-xorg x11-xserver-utils openbox \
   python3-gi gir1.2-gtk-3.0 gdisk parted dosfstools \
   | tee /tmp/live-packages.log"
 
+# Modern Xorg refuses to run as root, so the live session runs as a dedicated
+# unprivileged user. It needs the tty group for the VT and video/input for
+# DRM + input devices.
+log "[1b/4] creating unprivileged session user (liveuser)"
+chroot_run "useradd -m -s /bin/bash liveuser 2>/dev/null || true
+usermod -aG tty,video,input,audio,cdrom,plugdev,users liveuser 2>/dev/null || true"
+
 # ── 3. ship the graphical installer + deploy tooling ────────────────────────
 log "[2/4] installing installer + deploy tooling"
 install -Dm0755 "$ROOT/installer/arcline-installer" "$LIVE_ROOT/usr/local/bin/arcline-installer"