ci: build the live ISO on push-to-main and publish as artifact

Adds `.forgejo/workflows/build-iso.yml` that runs `./iso/build.sh` and
uploads the resulting ISO as a `furtka-iso` artifact (retained 14 days).
Triggers on `push: branches: [main]` and `workflow_dispatch` only —
feature branches don't pay the 15-20 min build cost. `concurrency`
cancels older runs of the same ref so only the most recent push
produces an artifact.

This is what Robert asked for: push change → download ISO from the
Forgejo run → test without needing a laptop to build.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.forgejo/workflows/build-iso.yml

@@ -0,0 +1,37 @@
+name: Build ISO
+
+# Full ISO build is ~15-20 min. Only run on push-to-main and manual
+# dispatch so feature-branch iteration stays fast. See
+# memory/project_ci_branching for the rationale.
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: build-iso-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build-iso:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build ISO
+        run: ./iso/build.sh
+
+      - name: Report ISO hash
+        run: |
+          iso=$(ls iso/out/*.iso | head -1)
+          echo "ISO: $iso"
+          sha256sum "$iso"
+
+      - name: Upload ISO artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: furtka-iso
+          path: iso/out/*.iso
+          retention-days: 14
+          if-no-files-found: error

iso/README.md

@@ -1,10 +1,10 @@
 # Live ISO build
 
-Builds a bootable Arch-based live ISO that auto-starts the Flask webinstaller from `../webinstaller/` on boot. User plugs in a USB, boots, and the installer wizard comes up on `http://<vm-ip>:5000`.
+Builds a bootable Arch-based live ISO that auto-starts the Flask webinstaller from `../webinstaller/` on boot. User plugs in a USB, boots, and the installer wizard comes up on `http://proksi.local:5000` (or the raw IP shown on the console).
 
-Directly runnable; CI integration comes later once the build is stable.
+Runnable locally (below) or through Forgejo Actions — `.forgejo/workflows/build-iso.yml` builds on every push to `main` and on manual `workflow_dispatch`. The ISO lands as an artifact named `furtka-iso`, retained for 14 days. Feature branches don't trigger the ISO build; see `memory/project_ci_branching` for why.
 
-## Run a build
+## Run a build locally
 
 Needs a host with Docker. Disk space required: ~15 GB scratch during the build, ~1.5 GB for the final ISO.