Add ISO user config: unattended install needs baked accounts

VM smoke test of the first ISO reached GDM but no user existed
(bootc-image-builder ISOs install unattended; gnome-initial-setup is
not in the bazzite base). iso-config.toml creates parent (wheel) and
kid with placeholder passwords to change on first login.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

BUILD-CONSOLE.md

@@ -18,6 +18,7 @@ mkdir -p output
 sudo podman run --rm -it --privileged \
   --security-opt label=type:unconfined_t \
   -v ./output:/output \
+  -v ./iso-config.toml:/config.toml:ro \
   -v /var/lib/containers/storage:/var/lib/containers/storage \
   quay.io/centos-bootc/bootc-image-builder:latest \
   --type iso --rootfs btrfs \
@@ -66,17 +67,25 @@ cid=$(docker create localhost/bc250-console-gnome:latest true)
 docker cp "$cid":/etc/pki/rpm-gpg ./rpm-gpg-keys
 docker rm "$cid"
 
-# 5. Build the ISO (--rootfs required: the image sets no root-fs-type)
+# 5. Build the ISO (--rootfs required: the image sets no root-fs-type;
+#    iso-config.toml REQUIRED — the ISO installs unattended and the image has
+#    no first-boot account wizard, so without baked users the install is
+#    unloginable)
 mkdir -p iso-output
 docker run --rm --privileged --security-opt label=type:unconfined_t \
   -v "$PWD"/iso-output:/output \
   -v "$PWD"/rpm-gpg-keys:/etc/pki/rpm-gpg:ro \
+  -v "$PWD"/iso-config.toml:/config.toml:ro \
   -v bib-storage:/var/lib/containers/storage \
   quay.io/centos-bootc/bootc-image-builder:latest \
   --type iso --rootfs btrfs \
   localhost/bc250-console-gnome:latest
 ```
 
+**Heads-up: the ISO wipes and auto-installs to the first disk with no
+prompts.** Accounts come from `iso-config.toml` (placeholder passwords —
+change on first login: `passwd`, and `sudo passwd kid`).
+
 ISO lands at `iso-output/bootiso/install.iso` (~5 GB), owned by root — fix
 with `docker run --rm -v "$PWD"/iso-output:/o alpine chown -R 1000:1000 /o`.