feat: run installer.sh automatically inside the live session

Uses dracut's official 20-apply-live-updates.sh pre-pivot hook: any
/updates/ directory tree present at the top level of the boot media
gets copied into the live root filesystem before pivoting, verbatim,
no initrd or squashfs/EROFS modification needed. build.sh assembles
this tree from scripts/, backends/, config/ (mapped under
/opt/tuxflotte) plus live-updates/etc/ (an XDG autostart entry that
opens a terminal running installer.sh as root, and a sudoers.d drop-in
granting liveuser passwordless sudo).

xorriso preserves the ownership/permissions recorded at map time, so
-chown_r/-chgrp_r 0 on /updates is enough to make sudoers accept the
drop-in as root-owned without needing local root to build the ISO.

This was tried first as a direct EROFS unpack/repack of
/LiveOS/squashfs.img (that file is actually EROFS despite the name on
current Fedora), but a fresh self-built erofs-utils (Debian's
packaged 1.5-1 can't even read this image's on-disk format) hit a
reproducible bug extracting the packed/fragmented inode into a single
corrupt file instead of a directory tree. The dracut hook sidesteps
that path entirely.

Verified end-to-end: booting either Tuxflotte entry reaches the
Cinnamon live desktop, autostarts a terminal, and installer.sh runs
through every module (network, hardware, enrollment, handshake,
device status, Bereitstellungsvorlage selection, commit point, Runtime
Blueprint resolution against the real server, full Fedora backend
lifecycle, storage detection) to a clean exit.

live-updates/etc/sudoers.d/90-tuxflotte

@@ -0,0 +1 @@
+liveuser ALL=(ALL) NOPASSWD: ALL

live-updates/etc/xdg/autostart/tuxflotte-installer.desktop

@@ -0,0 +1,6 @@
+[Desktop Entry]
+Type=Application
+Name=Tuxflotte Provisioning
+Exec=gnome-terminal --title="Tuxflotte Provisioning" -- bash -c 'sudo /opt/tuxflotte/scripts/installer.sh; rc=$?; echo; echo "--- installer.sh beendet (Exit-Code: $rc) ---"; exec bash'
+X-GNOME-Autostart-enabled=true
+NoDisplay=true

scripts/build.sh

@@ -64,6 +64,22 @@ verify_workdir() {
   echo "GRUB verification passed."
 }
 
+prepare_updates() {
+  echo "Assembling live-updates payload..."
+
+  local updates_dir="$WORK_DIR/updates"
+
+  rm -rf "$updates_dir"
+  mkdir -p "$updates_dir/opt/tuxflotte"
+
+  cp -a "$REPO_DIR/live-updates/etc" "$updates_dir/"
+  cp -a "$REPO_DIR/scripts" "$updates_dir/opt/tuxflotte/"
+  cp -a "$REPO_DIR/backends" "$updates_dir/opt/tuxflotte/"
+  cp -a "$REPO_DIR/config" "$updates_dir/opt/tuxflotte/"
+
+  chmod 0440 "$updates_dir/etc/sudoers.d/90-tuxflotte"
+}
+
 create_iso() {
   echo "Creating Tuxflotte ISO..."
 
@@ -77,6 +93,9 @@ create_iso() {
     -compliance no_emul_toc \
     -map "$REPO_DIR/grub/EFI-BOOT-grub.cfg" /EFI/BOOT/grub.cfg \
     -map "$REPO_DIR/grub/boot-grub2-grub.cfg" /boot/grub2/grub.cfg \
+    -map "$WORK_DIR/updates" /updates \
+    -chown_r 0 /updates -- \
+    -chgrp_r 0 /updates -- \
     -boot_image any replay
 
   echo "ISO created: $output_iso"
@@ -89,6 +108,7 @@ main() {
   extract_iso
   patch_grub
   verify_workdir
+  prepare_updates
   create_iso
 
   echo