Add an unattended-install ISO builder

Boot the stick, pick one GRUB entry, walk away: it wipes the target disk, installs Ubuntu
26.04.1 with the NVIDIA driver and codecs, and runs setup.sh on first boot to install the
apps. build-iso.sh does the image surgery in a container, so the build machine needs nothing
but podman.

The wipe is pinned to one disk serial (the 990 PRO). The Data drive can't match it, and an
unmatched disk stops the install rather than guessing — so the stick can't eat another
machine either. The autoinstall entry is not the GRUB default, so an accidental boot lands in
the ordinary Ubuntu installer.

Verified by running the install in a VM with two virtual NVMe drives carrying the real
serials: unattended start to finish, target partitioned and installed, Data disk byte-for-byte
identical, and late-commands left /opt/main-desktop plus the enabled first-boot service in
place. Testing caught the autoinstall args landing after '---' (where they reach the installed
system instead of the installer, and do nothing), and the first-boot run adding root rather
than ckoch to the docker group, since runuser leaves $USER alone.

setup.sh gains an unattended mode for that first-boot run, waits out the dpkg lock that
Ubuntu's own boot-time upgrades hold, waits for snapd to finish seeding before removing the
Firefox snap, and skips the driver step on machines with no NVIDIA card.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

iso/user-data.in

@@ -0,0 +1,54 @@
+#cloud-config
+# Unattended install for main-desktop. scripts/build-iso.sh fills in the placeholders
+# and drops this on the ISO as /nocloud/user-data.
+autoinstall:
+  version: 1
+
+  # Stock Ubuntu desktop, not the -minimal variant, so LibreOffice and the usual
+  # desktop apps come along as debs.
+  source:
+    id: ubuntu-desktop
+
+  # This is what installs the NVIDIA driver (the recommended open branch on this
+  # hardware), so the GPU works on first boot and Flatpak can match its GL runtime
+  # straight away. codecs pulls ubuntu-restricted-addons.
+  drivers:
+    install: true
+  codecs:
+    install: true
+
+  identity:
+    realname: '@@REALNAME@@'
+    username: '@@USERNAME@@'
+    hostname: '@@HOSTNAME@@'
+    password: '@@PASSWORD_HASH@@'
+
+  # ONE disk is touched, matched by serial. @@TARGET_MODEL@@ is the target; the other
+  # NVMe in this machine never matches, and if nothing matches, the install stops
+  # instead of guessing. That also means this ISO can't wipe a different machine.
+  storage:
+    layout:
+      name: direct
+      match:
+        serial: '@@TARGET_SERIAL@@'
+
+  packages:
+    - git
+    - curl
+    - ca-certificates
+
+  late-commands:
+    # Bake this repo into the installed system and arm the one-shot first-boot run
+    # of setup.sh, which installs everything in flatpaks.txt and the rest.
+    - cp -r /cdrom/main-desktop /target/opt/main-desktop
+    - chmod +x /target/opt/main-desktop/scripts/firstboot.sh /target/opt/main-desktop/scripts/setup.sh
+    - cp /cdrom/main-desktop/iso/main-desktop-firstboot.service /target/etc/systemd/system/
+    # Passwordless sudo so the first-boot run doesn't stall on a password prompt.
+    # firstboot.sh deletes this again on its way out, pass or fail.
+    - >-
+      printf '%s ALL=(ALL) NOPASSWD:ALL\n' '@@USERNAME@@'
+      > /target/etc/sudoers.d/99-main-desktop-firstboot
+    - chmod 440 /target/etc/sudoers.d/99-main-desktop-firstboot
+    - curtin in-target -- systemctl enable main-desktop-firstboot.service
+
+  shutdown: reboot