ci: split ISO into 1900M chunks for GH release upload

GH release asset size limit = 2 GiB. Veilor ISO ~2.8 GiB (KDE base +
hardening + grafted /veilor/ tree). zstd -19 only achieves 96.67%
compression (squashfs already xz-compressed). Splitting is the fix.

Workflow now:
- Splits ISO with `split -b 1900M -d --suffix-length=2`
- Drops original ISO before upload (would fail at >2 GiB)
- Includes per-part sha256 for reassembly verification
- Release notes include cat reassembly command

test/auto-install.sh will need follow-up commit to download + cat
the parts before booting.

.github/workflows/build-iso.yml

@@ -169,14 +169,27 @@ jobs:
             ls -lh "$ISO_NAME"
 
       # ── ISO publish ────────────────────────────────────────────────────
-      # Use GitHub Releases (not Actions artifacts) for ISO storage.
-      # Reason: artifact quota maxed at 50GB on Pro tier with ~18 ISOs.
-      # Releases have effectively unlimited storage per public/private repo.
-      # On every successful build of main, update the rolling `ci-latest`
-      # prerelease draft. Tag releases (`v*.*.*`) get a separate proper
-      # release. Build logs stay as artifacts (they're tiny + opt-in only
-      # on failure).
-      - name: Publish ISO to ci-latest rolling prerelease
+      # GH Release asset size limit = 2 GiB. Our ISO ~2.8 GiB. Split into
+      # chunks before upload. Reassemble client-side via `cat *.part-* > x.iso`.
+      # Squashfs is already near-incompressible (zstd -19 → 96%) so split,
+      # not compress.
+      - name: Split ISO into 2GiB chunks
+        if: success() && github.ref == 'refs/heads/main'
+        run: |
+          cd build/out
+          ISO=$(ls *.iso | head -1)
+          [ -n "$ISO" ] || { echo "[ERR] no ISO"; exit 1; }
+          # Split with 1900M chunks (under 2 GiB safe). Suffix .part-aa, .part-ab, ...
+          split -b 1900M -d --suffix-length=2 "$ISO" "${ISO}.part-"
+          ls -lh
+          # Drop the original ISO so it doesn't try to upload (over limit)
+          rm -f "$ISO"
+          # Generate sha256 of all parts so reassembly is verifiable
+          sha256sum *.part-* > "${ISO}.parts.sha256"
+          echo "[OK] split into:"
+          ls "${ISO}".part-*
+
+      - name: Publish to ci-latest rolling prerelease
         if: success() && github.ref == 'refs/heads/main'
         uses: softprops/action-gh-release@v2
         with:
@@ -184,11 +197,20 @@ jobs:
           name: "ci-latest (auto)"
           body: |
             Rolling auto-build from `main`. Latest commit: ${{ github.sha }}.
-            Replaces on every push. Not a stable release — for testing only.
+
+            **ISO is split into chunks (GH release 2 GiB asset limit).**
+            Reassemble:
+            ```
+            cat veilor-os-*.iso.part-* > veilor-os.iso
+            sha256sum -c veilor-os-*.iso.parts.sha256
+            ```
+            Or use `test/auto-install.sh` which handles reassembly automatically.
+
+            Not a stable release — for testing only.
           prerelease: true
           make_latest: false
           files: |
-            build/out/*.iso
+            build/out/*.iso.part-*
             build/out/*.sha256
 
       # Build log on failure: print inline + skip artifact upload to avoid