Bake Sunshine remote admin + add one-command configured ISO builder

- Sunshine flatpak in first-boot list; autostarts with the console
  account's session (bc250-sunshine-autostart, honors CONSOLE_KID_USER)
- bc250-personalize: one-shot display names from /etc/bc250-console.conf
- build-console.sh + console.env(.example): fill in usernames/passwords/
  display names, get a fully personalized ISO — no post-install steps
  beyond per-account logins. Generated files git-ignored (credentials)
- Docs: Moonlight is the remote-admin path; RDP marked blocked by the
  mutter cursor-metadata screencast crash on GFX1013

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

OPERATIONS.md

@@ -13,7 +13,16 @@ kid's password any time: `sudo passwd kid`.
 | | Command / client | Works when |
 |---|---|---|
 | SSH (terminal) | `ssh parent@<console-address>` | Always (console is never asleep) |
-| RDP (see the screen) | Any RDP client → `<console-address>:3389` | Only while the kid's session is logged in |
+| Moonlight (see + control the screen) | [Moonlight](https://moonlight-stream.org) → console → **Desktop** | Only while the kid's session is logged in |
+
+One-time Moonlight pairing: browse to `https://<console-address>:47990`,
+create the Sunshine admin login, then enter the PIN Moonlight shows you in
+Sunshine's PIN tab. Sunshine starts automatically with the kid's session.
+
+> Why not RDP? GNOME Remote Desktop crashes the session on this GPU
+> (mutter 50.x cursor-metadata screencast segfault on cyan-skillfish).
+> `bc250-remote-setup` still configures it if you want to retry after a
+> future mutter update — but Moonlight is smoother anyway.
 
 `<console-address>`: the LAN IP, or (recommended) the Tailscale name/IP so it
 works from anywhere. Never port-forward 22/3389 on the router.