packaging/iso: uninstall safety, fail-closed AUR updates, no sshd on live ISO

- tanin-greet.install: post_remove restores the previous greetd config —
  removing the package no longer leaves greetd pointing at a dead binary
- aur-autoupdate: skip packages when the AUR RPC is unreachable instead of
  building blind (fail closed)
- build-tanin-repo: per-package makepkg logs instead of >/dev/null
- live ISO: drop sshd.service enablement (root has an empty password on the
  live medium); encoded in bootstrap-profile.sh so it survives re-bootstrap
- gtklock config: de-personalize hardcoded /home/karim path, mark as
  not-yet-packaged reference
- tanin-desktop PKGBUILD: correct stale AUR-vs-extra comments (gtklock,
  awww, cliphist are in extra), document the eww-git provides=eww contract
- docs/distribution.md: mark SigLevel TrustAll as temporary/insecure, add
  repo-signing TODO (repo-add -s, SigLevel Required), tick done roadmap items
- tanin-calendar + niri-config.kdl: pending session work

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

iso/bootstrap-profile.sh

@@ -38,6 +38,13 @@ install -m644 "$HERE/overrides/profiledef.sh" "$PROFILE/profiledef.sh"
 install -m644 "$HERE/overrides/pacman.conf"   "$PROFILE/pacman.conf"
 cp -rT "$HERE/overrides/airootfs" "$PROFILE/airootfs"
 
+echo "==> security: do NOT enable sshd on the live ISO"
+# releng ships root with an empty password AND enables sshd (PermitRootLogin yes)
+# -> open remote root on any network the live ISO joins. We don't need sshd for
+# the installer, so drop the wants-symlink. This is re-applied on every bootstrap
+# because build-profile is regenerated from releng above (authoritative fix).
+rm -f "$PROFILE/airootfs/etc/systemd/system/multi-user.target.wants/sshd.service"
+
 echo "==> profile ready: $PROFILE"
 WORK=/tmp/tanin-work
 if [ "${1:-}" = "--build" ]; then