feat: custom boot branding, MBR fix, Plymouth theme, CI smoke tests

Boot fix:
- Ship proven Debian Live MBR (4552) as branding/isohdpfx.bin — the
  ISOLINUX package MBR (33ed) doesn't boot on all hardware. This was
  the root cause of "machine doesn't pick up the USB".

Branding:
- Custom GRUB background: pixel-art floating island (1024x574)
- Archipelago pixel-art logo for Plymouth boot splash
- GRUB theme: dark background, orange selected item, no broken font refs
- Plymouth theme: script-based with progress bar, LUKS prompt support
- Plymouth + splash added to target rootfs packages
- GRUB theme installed on both installer ISO and target system
- Serial console (ttyS0) added to kernel params for QEMU debugging

CI improvements:
- Smoke test step: mounts ISO, verifies all critical files, checks
  initrd has live-boot, confirms boot=live in grub.cfg. Fails build
  before copying to Builds if any check fails.

Dev workflow:
- dev-branding.sh: extract ISO, swap branding, repackage, boot in QEMU
  (~10 seconds vs 20 min full rebuild)
- generate-grub-background.py: procedural cyberpunk background generator
- generate-plymouth-logo.py: procedural logo generator
- Improved test-iso-qemu.sh: --bios/--nographic flags, serial logging

Build:
- Simplified live-boot install (clean chroot, no complex fallbacks)
- Static branding images preferred, generators as fallback

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitea/workflows/build-iso-dev.yml

@@ -54,6 +54,61 @@ jobs:
             ARCHIPELAGO_BIN="$ARCHIPELAGO_BIN" \
             ./build-auto-installer-iso.sh
 
+      - name: Smoke test ISO
+        run: |
+          ISO=$(ls image-recipe/results/archipelago-installer-unbundled-*.iso 2>/dev/null | head -1)
+          if [ -z "$ISO" ]; then
+            echo "FAIL: No ISO produced"
+            exit 1
+          fi
+          echo "ISO: $ISO ($(du -h "$ISO" | cut -f1))"
+
+          # Mount and verify structure
+          MNT=$(mktemp -d)
+          sudo mount -o loop,ro "$ISO" "$MNT"
+
+          FAIL=0
+          for f in live/vmlinuz live/initrd.img live/filesystem.squashfs \
+                   isolinux/isolinux.bin isolinux/isolinux.cfg \
+                   boot/grub/grub.cfg EFI/BOOT/BOOTX64.EFI \
+                   archipelago/auto-install.sh archipelago/rootfs.tar; do
+            if [ -e "$MNT/$f" ]; then
+              echo "  OK: $f ($(sudo du -h "$MNT/$f" 2>/dev/null | cut -f1))"
+            else
+              echo "  MISSING: $f"
+              FAIL=1
+            fi
+          done
+
+          # Verify initrd has live-boot
+          INITRD_DIR=$(mktemp -d)
+          sudo unmkinitramfs "$MNT/live/initrd.img" "$INITRD_DIR" 2>/dev/null
+          if [ -e "$INITRD_DIR/scripts/live" ] || [ -e "$INITRD_DIR/main/scripts/live" ]; then
+            echo "  OK: initrd has live-boot scripts"
+          else
+            echo "  MISSING: live-boot scripts in initrd!"
+            echo "  initrd scripts/: $(ls "$INITRD_DIR/scripts/" 2>/dev/null || ls "$INITRD_DIR/main/scripts/" 2>/dev/null)"
+            FAIL=1
+          fi
+
+          # Check GRUB config has boot=live
+          if grep -q "boot=live" "$MNT/boot/grub/grub.cfg"; then
+            echo "  OK: grub.cfg has boot=live"
+          else
+            echo "  MISSING: boot=live in grub.cfg"
+            FAIL=1
+          fi
+
+          sudo umount "$MNT" 2>/dev/null
+          rmdir "$MNT" 2>/dev/null
+          sudo rm -r "$INITRD_DIR" 2>/dev/null
+
+          if [ "$FAIL" = "1" ]; then
+            echo "SMOKE TEST FAILED"
+            exit 1
+          fi
+          echo "SMOKE TEST PASSED"
+
       - name: Copy to Builds
         run: |
           ISO=$(ls image-recipe/results/archipelago-installer-unbundled-*.iso 2>/dev/null | head -1)