fix: ensure the ISO is actually UEFI-bootable

BOOT=efi only changed the GRUB inside the rootfs squashfs — grub-mkrescue
builds the ISO bootloader from the build host's GRUB, so an ISO assembled
on a host without the x86_64-efi modules + mtools shipped with NO UEFI
boot entry. Booting that ISO on a UEFI machine showed:

    "make sure there is a bootable uefi x64 image"

- check-host-deps.sh now verifies the GRUB module dirs it needs for a
  hybrid ISO (/usr/lib/grub/x86_64-efi from grub-efi-amd64-bin,
  /usr/lib/grub/i386-pc from grub-pc-bin) and mtools, not just
  grub-mkrescue.
- build-iso.sh verifies the finished ISO has both EFI and BIOS boot
  entries (xorriso El Torito report) and prints the result; BOOT=efi
  builds FAIL if the EFI entry is missing.
- GitLab CI build image gains grub-pc-bin, grub-efi-amd64-bin, mtools.
- docs/building.md: hybrid-ISO burning instructions (dd) and the
  "bootable uefi x64 image" troubleshooting path.

docs/building.md

@@ -120,3 +120,33 @@ The ISO boots a **live** system (via `live-boot`): the rootfs is compressed to
 a squashfs and mounted on boot, so you can try an edition before installing it
 to disk. The same rootfs can be installed with the btrfs layout via
 `btrfs/init.sh` (the installer is follow-up work — see `docs/architecture.md`).
+
+### Burning the ISO
+
+The ISO is **hybrid** (BIOS + UEFI). Write it to a USB stick with `dd` (or
+Ventoy), not as a file copy:
+
+```bash
+sudo dd if=build/artifacts/arcline-server-0.1.0-amd64.iso of=/dev/sdX bs=4M status=progress
+```
+
+The build verifies the finished ISO actually contains **both** boot entries and
+prints `✓ EFI boot entry present` / `✓ BIOS boot entry present`; `BOOT=efi`
+builds **fail** if the EFI entry is missing.
+
+### UEFI says "make sure there is a bootable uefi x64 image"
+
+That firmware error means the ISO had no UEFI boot entry. `grub-mkrescue`
+builds the ISO bootloader from the **build host's** GRUB, so the host needs the
+UEFI modules even though the image is `BOOT=efi`:
+
+```bash
+sudo apt-get install -y grub-efi-amd64-bin grub-pc-bin mtools
+scripts/check-host-deps.sh   # should now pass; rebuild the ISO
+```
+
+If the entry was present but it still won't boot, enable/disable Secure Boot
+(our `BOOT=bios` ISOs are unsigned and will be refused by Secure Boot — use
+`BOOT=efi make iso-server` plus the MOK flow in `docs/secureboot.md` for
+signed, Secure-Boot-friendly media).
+