feat: graphical installer in the live ISO

The ISO now boots straight into a GTK installer instead of dropping to a
tty. Structure:

- installer/arcline-installer: small GTK3 (Python) frontend that drives
  scripts/deploy-disk.sh — pick a disk, choose boot mode, type the device
  path to confirm, watch the deploy log, reboot. Pure helper logic is
  tested against lsblk (lowercase keys, pseudo-devices filtered).
- scripts/build-live.sh: builds build/rootfs/<edition>-live by cloning the
  CLEAN rootfs and layering on live-boot, a minimal X session (Xorg +
  openbox), the installer, and the deploy tooling under /usr/lib/arcline
  (deploy-disk.sh + btrfs/init.sh + edition fstabs, laid out so the
  scripts' own path resolution works unchanged).
- overlays/live/: arcline-installer.service + session script that start
  Xorg on vt1 (with -allow-root) and run the installer as the X client.
- build-iso.sh: builds the live rootfs for the squashfs AND stages the
  clean rootfs archive into isofiles/install/ — the installer deploys the
  clean archive, so what's installed is the hardened system, never the
  live session with the installer in it.
- Refactor: ARCLINE_LIVE handling removed from build-rootfs.sh and
  configure-system.sh (now lives entirely in build-live.sh).
- validate.sh now checks overlays shell scripts + installer python.
- docs updated (building.md, architecture.md, installer/README.md).

docs/building.md

@@ -116,10 +116,19 @@ independent of the toolchain and always included.
 
 ## Notes on the ISO
 
-The ISO boots a **live** system (via `live-boot`): the rootfs is compressed to
-a squashfs and mounted on boot, so you can try an edition before installing it
-to disk. The same rootfs can be installed with the btrfs layout via
-`btrfs/init.sh` (the installer is follow-up work — see `docs/architecture.md`).
+The ISO is a **graphical installer** medium: it boots to a minimal live
+session (Xorg) that auto-starts the Arcline installer window. Pick a target
+disk, confirm the device path, and it installs to disk with the btrfs layout,
+GRUB, and a real fstab — driven by the same `deploy-disk.sh` core as the
+scripted installer.
+
+The live session is built by `build-live.sh` on top of the **clean** rootfs;
+the ISO carries that clean rootfs as the install source (`install/`), so what
+lands on disk is the hardened installed system — never the live session with
+the installer in it.
+
+Install a user + desktop afterwards if you want a graphical login
+(workstation edition already ships KDE Plasma + SDDM and boots to it).
 
 ### Burning the ISO