Fonts + kitty config in the desktop

- tanin-eww: ship Fuji kitty.conf into skel (~/.config/kitty)
- add missing font deps to tanin-eww + tanin-desktop:
  ttc-iosevka-aile (bar's 'Iosevka Aile' UI font) + ttf-nerd-fonts-symbols
  ('Symbols Nerd Font' icon fallback). ttf-iosevka-nerd covers kitty.
- start archiso profile under iso/ (releng-base + overrides; systemd-boot,
  btrfs+snapshots, plymouth, linux-zen, Calamares clone-install)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

iso/overrides/airootfs/etc/calamares/settings.conf

@@ -0,0 +1,54 @@
+# Calamares for TANINUX (camel). Model: clone the live system to the target with
+# unpackfs, then configure bootloader (systemd-boot), services (greetd), set up
+# snapper + Flathub, and strip the live-only installer bits.
+---
+modules-search: [ local, /usr/lib/calamares/modules ]
+
+instances:
+- id:     snapper
+  module: shellprocess
+  config: shellprocess-snapper.conf
+- id:     flathub
+  module: shellprocess
+  config: shellprocess-flathub.conf
+- id:     striplive
+  module: shellprocess
+  config: shellprocess-striplive.conf
+
+sequence:
+- show:
+  - welcome
+  - locale
+  - keyboard
+  - partition
+  - users
+  - summary
+- exec:
+  - partition
+  - mount
+  - unpackfs
+  - machineid
+  - fstab
+  - locale
+  - keyboard
+  - localecfg
+  - luksbootkeyfile
+  - users
+  - networkcfg
+  - hwclock
+  - shellprocess@snapper
+  - shellprocess@flathub
+  - shellprocess@striplive
+  - packages          # remove live-only packages (calamares, cage)
+  - services-systemd  # enable greetd + NetworkManager on the target
+  - mkinitcpio        # regenerate initramfs (plymouth hook)
+  - bootloader        # systemd-boot, kernel cmdline 'quiet splash'
+  - umount
+- show:
+  - finished
+
+branding: tanin
+prompt-install: true
+dont-chroot: false
+oem-setup: false
+disable-cancel: false

iso/overrides/airootfs/etc/pacman.conf

@@ -0,0 +1,25 @@
+# pacman.conf for the LIVE system and (via unpackfs) the installed target.
+# [tanin]'s DB-signing key is imported into the keyring by customize_airootfs.sh,
+# so Optional TrustAll verifies cleanly here (unlike the build conf which uses Never).
+[options]
+HoldPkg     = pacman glibc
+Architecture = auto
+CheckSpace
+SigLevel    = Required DatabaseOptional
+LocalFileSigLevel = Optional
+ParallelDownloads = 5
+Color
+ILoveCandy
+
+[core]
+Include = /etc/pacman.d/mirrorlist
+
+[extra]
+Include = /etc/pacman.d/mirrorlist
+
+[multilib]
+Include = /etc/pacman.d/mirrorlist
+
+[tanin]
+SigLevel = Optional TrustAll
+Server = https://git.openbureau.ch/api/packages/karim/arch/tanin/$arch

iso/overrides/airootfs/etc/pacman.d/tanin-repo.gpg

@@ -0,0 +1,32 @@
+-----BEGIN PGP PUBLIC KEY BLOCK-----
+
+xsBNBGo1eZsBCADJBsWkBZL08x/4d/mftfd30rcRkQJVDX3eEMHaZWeUSLfGt5Hj
+m7fYnwnBK29g04UTCjDKRGsvOqukAJQUXGLpLxSPJwsUH+kVKv+8/RCXtrQ6HTCN
+auyZGQ3ST8kcAQ+7jntumTehBt+z4LRGMow71W2JL1oqkMK9hEgAA7dqwEWN4K0w
+DMSd9iZOpN5PPdvVlTsvxU6JflfyLOS3W+geyL2+zFQWMmCcAqkPxTH6yNAfaoLI
+OGR4Mg6MXXdAXbzQKI90445fWGsUX/Ch5ZSWJhJ3wqjUM3r99PErL+C/p0r5wTqv
+LFkjZvauI+oLUZwXrP93qfzTG/iChBG+5sJLABEBAAHNDyhBcmNoIFJlZ2lzdHJ5
+KcLAuwQTAQgAbwWCajV5mwILBwkQtv3zViBq9PY1FAAAAAAAHAAQc2FsdEBub3Rh
+dGlvbnMub3BlbnBncGpzLm9yZ/ekKg/zx/iqmv/2hOAR9m8CFQgCFgACGQECmwMC
+HgEWIQRj8EFYeTI/a/4Pv7K2/fNWIGr09gAAdPIIAI4b/4C83biB4yD10w/u9Feb
+s4fn0nauZ/ayZ1JJaq20Ss2pBZaqETxNdIi9sQpno9BXhBRaNdd6k7YIUK7XTylr
+lk6V6Rhz6NIquGZHmfp1oszL4FjLUM9QoFWQaRY76psBNHWto/GgPpq8GFtVxmVj
+NhOpm/7EcGhniBS+engub7vazVpEIqPycKBBbKSxTvo3hVqsSJpaR2vB1aiLedvY
+luYfu/OIhT7SOOdjYTT18kMJxlwwSnhbl1cl47Jcd/1iQB5nwrWnZy28osfsIhEd
+4lxppWcgQDXWbzBV57HiTbfnNCncmBIhoTmCKRxosWJPiligeqsqoty/B7lBx47O
+wE0EajV5mwEIAO800GVtfe0ZWs+LljaKgkrwWi/u+dsVFgRNWdmqtOBWdszVdxyz
+M0LsNMHHOxAWFfjFFbSO9D06aHgmvzLH0c+fgaJeliXFMYS9nOKS7Q6djnjoYtZc
+CPxac0JlcLiysHyBdatjHHZr6KZvGaoSobzEfASpfYpScvEyGvi3KN2xD6ssw7AY
+GiPof+vAmsfDn0OFo1WRk7eEnoT7JvUx3RrDatXLvBcQRf+49AJvf2lBv0c4tnc8
+9O71wleTHZjL8x0oc3tFDCMBfSGmLzpOaTtgwCPI99yzHeGJGP7JyjUWSAi6WkX4
+COLPhufJC/pJSrvoLa1MzUBU+jfTkJnn8ZkAEQEAAcLArAQYAQgAYAWCajV5mwkQ
+tv3zViBq9PY1FAAAAAAAHAAQc2FsdEBub3RhdGlvbnMub3BlbnBncGpzLm9yZzPl
+jzz26YEAPcqM+A/M9x8CmwwWIQRj8EFYeTI/a/4Pv7K2/fNWIGr09gAAtaMH/3hS
+njGRszJFLsFNUYzgKdv1YYIENsFzSsu00CztKUrYVQxAEOK22mB3a9/3jPlJFSkS
+WR8D2rbC2/HUKhRnHomb8Mri6HzVmGEORuE5kNnZd3ij+Dnv7EsNC7DXmuoCZaFI
+FKYinsLEpo0bZOACaJpGTH4HqNM49Mrq2vREnuDtPdHGEYOs/+VqBt7tpmpIxGLd
+TsJNtdroThqle9ghaCwcSqF4YatTGsNpQI68OmkmQc1ybxhzpRdwajrdTrio2pI9
+ZkfLRBu7pRjn5ekDX4JUNkC1VyO4BuZutjtFRh8YAB0TbFfPmdn3i4/gI2u5rSi1
+UT+fYccVqz5tKm/iXTY=
+=6SFS
+-----END PGP PUBLIC KEY BLOCK-----

iso/overrides/airootfs/etc/systemd/system/getty@tty1.service.d/autologin.conf

@@ -0,0 +1,3 @@
+[Service]
+ExecStart=
+ExecStart=-/usr/bin/agetty --autologin root --noclear %I 38400 linux