feat: graphical installer in the live ISO

The ISO now boots straight into a GTK installer instead of dropping to a
tty. Structure:

- installer/arcline-installer: small GTK3 (Python) frontend that drives
  scripts/deploy-disk.sh — pick a disk, choose boot mode, type the device
  path to confirm, watch the deploy log, reboot. Pure helper logic is
  tested against lsblk (lowercase keys, pseudo-devices filtered).
- scripts/build-live.sh: builds build/rootfs/<edition>-live by cloning the
  CLEAN rootfs and layering on live-boot, a minimal X session (Xorg +
  openbox), the installer, and the deploy tooling under /usr/lib/arcline
  (deploy-disk.sh + btrfs/init.sh + edition fstabs, laid out so the
  scripts' own path resolution works unchanged).
- overlays/live/: arcline-installer.service + session script that start
  Xorg on vt1 (with -allow-root) and run the installer as the X client.
- build-iso.sh: builds the live rootfs for the squashfs AND stages the
  clean rootfs archive into isofiles/install/ — the installer deploys the
  clean archive, so what's installed is the hardened system, never the
  live session with the installer in it.
- Refactor: ARCLINE_LIVE handling removed from build-rootfs.sh and
  configure-system.sh (now lives entirely in build-live.sh).
- validate.sh now checks overlays shell scripts + installer python.
- docs updated (building.md, architecture.md, installer/README.md).

docs/architecture.md

@@ -33,11 +33,13 @@ Pipeline stages live in `scripts/`:
 |-------|--------|--------------|
 | bootstrap | `build-rootfs.sh` | debootstrap minbase, apt sources, package install |
 | overlay | `apply-overlays.sh` | copies `overlays/base` + `overlays/<edition>` into the rootfs |
-| configure | `configure-system.sh` | runs *in the chroot*: hostname, locale, kernel cmdline, services, live-boot, toolchain |
-| package | `build-iso.sh` | kernel + initramfs + squashfs → hybrid BIOS/UEFI ISO |
+| configure | `configure-system.sh` | runs *in the chroot*: hostname, locale, kernel cmdline, services, toolchain |
+| live | `build-live.sh` | clone clean rootfs → live session (live-boot + X + graphical installer) |
+| package | `build-iso.sh` | live rootfs → hybrid BIOS/UEFI ISO, plus the clean install archive |
 | image | `build-image.sh` | rootfs → bootable qcow2/raw disk image (via `deploy-disk.sh`) |
 | deploy | `deploy-disk.sh` | partition → btrfs layout → copy rootfs → GRUB + fstab (shared by image + installer) |
 | install | `install.sh` | scripted installer for a real disk (confirmation-gated) |
+| GUI install | `installer/arcline-installer` | GTK frontend booted by the live ISO (drives `deploy-disk.sh`) |
 | orchestrate | `build-edition.sh` / `Makefile` | wire the above to `make iso-<edition>` |
 
 ## The source trees
@@ -75,6 +77,9 @@ The four original follow-up items are implemented:
    observability stack installs without upstream repos.
 4. **Secure boot** — MOK-based signing (`scripts/secureboot/`), off by
    default, enabled with `ARCLINE_SIGN=1`.
+5. **Graphical installer** — the live ISO now boots straight into a GTK
+   installer (`installer/arcline-installer`) that drives `deploy-disk.sh`,
+   instead of dropping to a tty.
 
 ## Still on the horizon