iso: fresh work dir each build (avoid stale-stage reuse) + modern bootmodes

mkarchiso reuses completed stages in the work dir -> a 'too short' build that
ships a stale airootfs. bootstrap now 'rm -rf' the work dir first. Also switch
profiledef bootmodes to the non-deprecated names (bios.syslinux, uefi.systemd-boot).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

iso/build-profile/profiledef.sh

@@ -16,9 +16,15 @@ airootfs_image_type="squashfs"
 airootfs_image_tool_options=('-comp' 'zstd' '-Xcompression-level' '19' '-b' '1M')
 bootstrap_tarball_compression=('zstd' '-c' '-T0' '--auto-threads=logical' '--long' '-19')
 file_permissions=(
+  # --- releng's entries (must keep — we replace releng's profiledef) ---
   ["/etc/shadow"]="0:0:400"
-  ["/etc/gshadow"]="0:0:400"
   ["/root"]="0:0:750"
+  ["/root/.automated_script.sh"]="0:0:755"
+  ["/root/.gnupg"]="0:0:700"
+  ["/usr/local/bin/choose-mirror"]="0:0:755"
+  ["/usr/local/bin/Installation_guide"]="0:0:755"
+  ["/usr/local/bin/livecd-sound"]="0:0:755"
+  # --- TANINUX additions ---
   ["/root/customize_airootfs.sh"]="0:0:755"
   ["/usr/local/bin/tanin-installer"]="0:0:755"
 )