iso/calamares: run grub-install + update-grub after bootloader, and fix eggs' own boot-fix from silently going stale

[cyryllo]

What's broken

The iso/ live-build Calamares sequence stops at bootloader:

- grubcfg
- bootloader
- shellprocess@post-install   # snapper only
- umount

Nothing re-runs grub-install/update-grub afterwards, and nothing repairs
the kernel files unpackfs writes. Two already-diagnosed bugs follow directly
from that gap:

• [Bug] ext4 install drops to "grub rescue>" on every boot (typing exit boots normally; needs manual grub-install + update-grub) #20 (hits ext4 and btrfs alike) — with installEFIFallback: true,
  Calamares copies shim/grubx64 into the removable EFI path but not the
  grub.cfg stub that belongs next to them. GRUB started from that path has
  no working prefix and drops to grub rescue> on first boot.
• Automatic installation with Btrfs ends in GRUB rescue (@boot/subvolume error) #12 (btrfs only) — the kernel/initrd unpackfs writes are missing the
  eof flag on their last extent (declared size isn't covered by the extent
  map). GRUB reads the extent tree and stops there ("premature end of file");
  Linux itself reads the same file fine, which is why it only shows at boot.

The fix for both already exists in this repo as
scripts/fix-eggs-calamares-boot.py and system/usr/local/bin/skillfish-fix-boot-extents
— but:

1. That fix only patches the eggs/penguins-eggs build pipeline (templates
   under /etc/penguins-eggs.d/distros/*/calamares/modules and the live
   /etc/calamares/modules on the build machine). It never touches
   iso/config/includes.chroot/etc/calamares/..., so an ISO built the
   documented way (docs/BUILD.md, iso/build.sh, plain live-build) ships
   with neither fix.
2. skillfish-fix-boot-extents lives under system/, which iso/ does not
   sync from — it was never actually shipped in a live-build ISO.
3. fix-eggs-calamares-boot.py itself isn't invoked by anything — not
   scripts/build-iso.sh, not CI. It has to be remembered and run by hand
   before every eggs produce, and a penguins-eggs package upgrade can
   silently overwrite the very templates it patches (as already happened once
   to customize-partitions.js/show.qml, per the comments in that file).

What this PR does

• Add iso/config/includes.chroot/etc/calamares/modules/shellprocess@boot_reconfigure.conf:
  after bootloader, run skillfish-fix-boot-extents, then grub-install
  twice (normal NVRAM entry + --removable), then update-grub. Content
  mirrors the already-verified RECONF_BODY in fix-eggs-calamares-boot.py.
• Ship skillfish-fix-boot-extents under iso/config/includes.chroot/usr/local/bin/
  (copied from system/, 755) so it actually exists on a live-build install.
• Wire shellprocess@boot_reconfigure into settings.conf's exec sequence,
  right after bootloader and before umount.
• scripts/build-iso.sh: run fix-eggs-calamares-boot.py before every
  eggs produce and abort the build if its own verify() fails, instead
  of relying on someone remembering to run it by hand. This closes gap deps(website): bump astro from 5.18.2 to 6.4.4 in /website in the astro group across 1 directory #3
  above for the eggs pipeline without touching the pipeline's logic itself.

How I tested this

I have not built or booted an ISO from iso/ with this change — no BC-250
hardware or VM available in this environment. What I did verify:

• bash -n scripts/build-iso.sh — syntax OK.
• The new shellprocess@boot_reconfigure.conf content is byte-for-byte the
  same script body already exercised and confirmed working in a VM per the
  comments in scripts/fix-eggs-calamares-boot.py ("verificato in VM il
  10/08/2026") — I only relocated it to the module Calamares actually loads
  for the iso/ pipeline, plus adjusted the sequence/settings wiring.
• skillfish-fix-boot-extents is copied unmodified from system/.

This needs a real install test before merging — both an ext4 install and
a btrfs install, checking that the system boots both from the NVRAM entry and
from the removable EFI fallback path. I'm not in a position to do that BC-250
hardware test myself; flagging it explicitly rather than claiming it's
verified.

Fixes #12, Fixes #20 (pending the hardware test above).