v0.2.3: os-release branding + admin user creation in %post

- kde-theme-apply.sh: search /etc/os-release.d/veilor (where overlay
  put it) before falling back to $REPO/overlay path. Rewire symlinks
  cleanly: /etc/os-release → ../usr/lib/os-release.
- Kickstart: useradd admin in chroot %post since livecd-creator skips
  the `user` directive (no installer phase). Blank pw + expired = forced
  reset at first login same as before.

kickstart/veilor-os.ks

@@ -212,8 +212,15 @@ bash $REPO/scripts/selinux/build-policy.sh || echo "[WARN] SELinux build failed;
 # Apply KDE theme + DuckSans + os-release branding
 bash $REPO/scripts/kde-theme-apply.sh
 
-# Force admin password set on first boot (chage expires immediately)
+# Force admin password set on first boot.
-chage -d 0 admin
+# livecd-creator does NOT honor `user` kickstart directive (it's a LIVE
+# image, no installer step). Create admin manually in chroot %post.
+if ! getent passwd admin >/dev/null; then
+    useradd -m -G wheel -s /bin/bash -c "veilor admin" admin
+    passwd -d admin           # blank password
+    chage -d 0 admin          # expire → forced reset on first login
+    echo "[INFO] admin user created (blank password, expired)"
+fi
 
 # zram swap (no disk swap; keys never leak to platter)
 dnf install -y zram-generator || true

scripts/kde-theme-apply.sh

@@ -49,10 +49,19 @@ ok "fontconfig: Fira Code = default font"
 
 # ── /etc/os-release branding ──
 info "Branding /etc/os-release"
-if [[ -f "$REPO/overlay/etc/os-release.d/veilor" ]]; then
+SRC_OSREL=""
-    install -m 0644 "$REPO/overlay/etc/os-release.d/veilor" /etc/os-release
+for cand in /etc/os-release.d/veilor "$REPO/overlay/etc/os-release.d/veilor"; do
-    ln -sf /etc/os-release /usr/lib/os-release 2>/dev/null || true
+    [[ -f $cand ]] && SRC_OSREL=$cand && break
-    ok "os-release set to veilor-os"
+done
+if [[ -n $SRC_OSREL ]]; then
+    # /etc/os-release is symlink to /usr/lib/os-release on Fedora.
+    # Overwrite the actual file and rewire symlinks deterministically.
+    rm -f /etc/os-release /usr/lib/os-release
+    install -m 0644 "$SRC_OSREL" /usr/lib/os-release
+    ln -sf ../usr/lib/os-release /etc/os-release
+    ok "os-release set to veilor-os (source: $SRC_OSREL)"
+else
+    warn "no os-release.d/veilor found — branding skipped"
 fi
 
 # ── Plymouth theme (optional) ──