fix: ensure the ISO is actually UEFI-bootable

BOOT=efi only changed the GRUB inside the rootfs squashfs — grub-mkrescue
builds the ISO bootloader from the build host's GRUB, so an ISO assembled
on a host without the x86_64-efi modules + mtools shipped with NO UEFI
boot entry. Booting that ISO on a UEFI machine showed:

    "make sure there is a bootable uefi x64 image"

- check-host-deps.sh now verifies the GRUB module dirs it needs for a
  hybrid ISO (/usr/lib/grub/x86_64-efi from grub-efi-amd64-bin,
  /usr/lib/grub/i386-pc from grub-pc-bin) and mtools, not just
  grub-mkrescue.
- build-iso.sh verifies the finished ISO has both EFI and BIOS boot
  entries (xorriso El Torito report) and prints the result; BOOT=efi
  builds FAIL if the EFI entry is missing.
- GitLab CI build image gains grub-pc-bin, grub-efi-amd64-bin, mtools.
- docs/building.md: hybrid-ISO burning instructions (dd) and the
  "bootable uefi x64 image" troubleshooting path.

scripts/check-host-deps.sh

@@ -31,6 +31,8 @@ NEEDED=(
   "openssl|openssl"
   "sbsign|sbsigntool"
   "sbverify|sbsigntool"
+  # hybrid ISO: mtools builds the embedded EFI image that grub-mkrescue uses
+  "mformat|mtools"
 )
 
 MISSING=()
@@ -49,6 +51,19 @@ for entry in "${NEEDED[@]}"; do
   fi
 done
 
+# grub-mkrescue assembles the ISO bootloader from the HOST's GRUB modules.
+# A missing x86_64-efi module set produces an ISO with no UEFI boot entry —
+# the exact cause of "make sure there is a bootable uefi x64 image" on UEFI
+# machines. Verify the module dirs directly (they are not binaries).
+for spec in "/usr/lib/grub/x86_64-efi:grub-efi-amd64-bin:UEFI" \
+            "/usr/lib/grub/i386-pc:grub-pc-bin:BIOS"; do
+  dir="${spec%%:*}"; rest="${spec#*:}"; pkg="${rest%%:*}"; what="${rest##*:}"
+  if [[ ! -d "$dir" ]]; then
+    warn "missing: GRUB $what modules in $dir (package: $pkg) — ISO will not boot via $what"
+    MISSING+=("$pkg")
+  fi
+done
+
 if [[ ${#MISSING[@]} -eq 0 ]]; then
   log "all host build dependencies present ✓"
   exit 0