packaging/iso: uninstall safety, fail-closed AUR updates, no sshd on live ISO

- tanin-greet.install: post_remove restores the previous greetd config —
  removing the package no longer leaves greetd pointing at a dead binary
- aur-autoupdate: skip packages when the AUR RPC is unreachable instead of
  building blind (fail closed)
- build-tanin-repo: per-package makepkg logs instead of >/dev/null
- live ISO: drop sshd.service enablement (root has an empty password on the
  live medium); encoded in bootstrap-profile.sh so it survives re-bootstrap
- gtklock config: de-personalize hardcoded /home/karim path, mark as
  not-yet-packaged reference
- tanin-desktop PKGBUILD: correct stale AUR-vs-extra comments (gtklock,
  awww, cliphist are in extra), document the eww-git provides=eww contract
- docs/distribution.md: mark SigLevel TrustAll as temporary/insecure, add
  repo-signing TODO (repo-add -s, SigLevel Required), tick done roadmap items
- tanin-calendar + niri-config.kdl: pending session work

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

packaging/build-tanin-repo.sh

@@ -13,7 +13,8 @@ set -uo pipefail
 HERE="$(cd "$(dirname "$0")" && pwd)"
 OUT="${TANIN_REPO_DIR:-$HOME/projects/tanin-repo}"
 DB="$OUT/tanin.db.tar.zst"
-mkdir -p "$OUT"
+LOGDIR="$OUT/logs"
+mkdir -p "$OUT" "$LOGDIR"
 
 # tanin-icons builds from the installed Adwaita theme -> needs librsvg + python.
 OWN_SIMPLE=(tanin-greet tanin-libadwaita tanin-setup tanin-eww tanin-icons tanin-desktop)
@@ -21,12 +22,14 @@ OWN_BUILD=(taninux)
 AUR_REBUILD=(eww-git tiramisu-git waypaper calamares librewolf-bin
              arch-update timeshift-autosnap xdg-terminal-exec paru)
 
+# makepkg output goes to a per-package log (console stays quiet); inspect the log
+# for warnings even on success. Log path is echoed so it's easy to find.
 build() {
-  local p="$1"
-  echo "==> building $p"
-  ( cd "$HERE/$p" && makepkg -d -f --noconfirm >/dev/null 2>&1 ) \
+  local p="$1" log="$LOGDIR/$p.log"
+  echo "==> building $p (log: $log)"
+  ( cd "$HERE/$p" && makepkg -d -f --noconfirm ) >"$log" 2>&1 \
     && cp "$HERE/$p/"*.pkg.tar.zst "$OUT/" 2>/dev/null \
-    && echo "   ok" || { echo "   FAILED ($p)"; return 1; }
+    && echo "   ok" || { echo "   FAILED ($p) — see $log"; return 1; }
 }
 
 for p in "${OWN_SIMPLE[@]}"; do build "$p"; done
@@ -39,6 +42,7 @@ for p in "${OWN_BUILD[@]}"; do
   fi
 done
 
+echo "** build logs (incl. makepkg warnings) in: $LOGDIR"
 echo "** AUR rebuilds TODO (not in official repos): ${AUR_REBUILD[*]}"
 echo "   build each with paru/makepkg and copy the .pkg.tar.zst into $OUT, then re-run."