Bake Sunshine remote admin + add one-command configured ISO builder

- Sunshine flatpak in first-boot list; autostarts with the console
  account's session (bc250-sunshine-autostart, honors CONSOLE_KID_USER)
- bc250-personalize: one-shot display names from /etc/bc250-console.conf
- build-console.sh + console.env(.example): fill in usernames/passwords/
  display names, get a fully personalized ISO — no post-install steps
  beyond per-account logins. Generated files git-ignored (credentials)
- Docs: Moonlight is the remote-admin path; RDP marked blocked by the
  mutter cursor-metadata screencast crash on GFX1013

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

BUILD-CONSOLE.md

@@ -1,5 +1,20 @@
 # BC-250 Console — local build → ISO
 
+## Quick path: build-console.sh
+
+```bash
+cp console.env.example console.env   # fill in usernames/passwords/display names
+./build-console.sh                   # → iso-output/bootiso/bc250-console-gnome.iso
+```
+
+The script runs the whole verified pipeline below and bakes your accounts
+(names, passwords, display names) and the console config into the ISO —
+a fresh install needs no post-install setup beyond per-account logins
+(Steam + Family View, Moonlight pairing, `sudo tailscale up`).
+`console.env` is git-ignored: it contains real passwords, never commit it.
+
+Everything below documents the manual pipeline the script automates.
+
 Custom recipe: `recipes/bc250-console-gnome.yml` (Bazzite GNOME + cyan-skillfish
 governor + SSH/RDP remote admin + BC-250 ttm kargs). Build path is **local**
 (no CI, no registry push, no cosign needed).