v0.5.1 build: vendor gum binary + graft /veilor/ onto ISO

- gum 0.17.0 pinned by sha256, downloaded into overlay/usr/local/bin/
  so installer can use Charm.sh TUI primitives.
- After livecd-creator produces ISO, extract+re-pack with /veilor/
  containing overlay+scripts+assets so installer-generated ks can
  copy them into target system at install time.

.github/workflows/build-iso.yml

@@ -64,7 +64,24 @@ jobs:
               createrepo_c \
               git \
               which \
-              shadow-utils
+              shadow-utils \
+              syslinux \
+              tar \
+              curl
+
+            # Vendor gum binary onto the ISO so the TTY1 installer can use
+            # Charm.sh TUI primitives. gum is not packaged in Fedora repos,
+            # so pull the upstream release tarball pinned by sha256.
+            GUM_VERSION="0.17.0"
+            GUM_URL="https://github.com/charmbracelet/gum/releases/download/v${GUM_VERSION}/gum_${GUM_VERSION}_Linux_x86_64.tar.gz"
+            GUM_SHA256="69ee169bd6387331928864e94d47ed01ef649fbfe875baed1bbf27b5377a6fdb"
+            mkdir -p /work/overlay/usr/local/bin
+            curl -fsSL "$GUM_URL" -o /tmp/gum.tgz
+            echo "$GUM_SHA256  /tmp/gum.tgz" | sha256sum -c -
+            tar -xzf /tmp/gum.tgz -C /tmp/
+            install -m 0755 "/tmp/gum_${GUM_VERSION}_Linux_x86_64/gum" /work/overlay/usr/local/bin/gum
+            /work/overlay/usr/local/bin/gum --version
+            echo "[OK] gum ${GUM_VERSION} vendored into overlay/usr/local/bin/"
 
             cd /work
 
@@ -102,6 +119,37 @@ jobs:
               --tmpdir /var/lmc \
               --cache /var/lmc-cache 2>&1 | tee build/out/build.log
 
+            # Graft veilor source tree onto the ISO so the installer-generated
+            # kickstart's `%post --nochroot` can find SRC at
+            # /run/install/repo/veilor/{overlay,scripts,assets}/ when the user
+            # promotes the live ISO into a real install.
+            ISO_FILE=$(ls /work/*.iso 2>/dev/null | head -1)
+            [ -n "$ISO_FILE" ] || { echo "[ERR] no ISO produced by livecd-creator"; exit 1; }
+            echo "[INFO] grafting /veilor/ onto $ISO_FILE"
+
+            # Inspect original boot stanza so the rebuild matches livecd-creator's layout.
+            xorriso -indev "$ISO_FILE" -report_el_torito as_mkisofs 2>&1 | tee /tmp/iso-boot.txt || true
+
+            mkdir -p /tmp/iso-mod
+            xorriso -osirrox on -indev "$ISO_FILE" -extract / /tmp/iso-mod
+            chmod -R u+w /tmp/iso-mod
+            mkdir -p /tmp/iso-mod/veilor
+            cp -a /work/overlay /work/scripts /work/assets /tmp/iso-mod/veilor/
+
+            xorriso -as mkisofs \
+              -volid "veilor-os-43" \
+              -isohybrid-mbr /usr/share/syslinux/isohdpfx.bin \
+              -eltorito-boot isolinux/isolinux.bin \
+              -eltorito-catalog isolinux/boot.cat \
+              -no-emul-boot -boot-load-size 4 -boot-info-table \
+              -eltorito-alt-boot \
+              -e images/efiboot.img -no-emul-boot \
+              -isohybrid-gpt-basdat \
+              -o "${ISO_FILE}.tmp" /tmp/iso-mod
+            mv "${ISO_FILE}.tmp" "$ISO_FILE"
+            rm -rf /tmp/iso-mod
+            echo "[OK] /veilor/ grafted onto $ISO_FILE"
+
             # Move output ISO to expected dir
             mv ./veilor-os-43.iso build/out/ 2>/dev/null || mv ./*.iso build/out/ 2>/dev/null || true