Add "Build kiosk ISO" GitHub Actions workflow

Manually triggered (workflow_dispatch): pick interactive /
unattended-kiosk / fully-automatic, optionally pre-set the admin user
(password from the KIOSK_ADMIN_PASSWORD repo secret, never a logged
input), hostname and SSH key. Runs iso/build-iso.sh and uploads the ISO
plus its sha256 as a run artifact (uncompressed, 3-day default retention).

build-iso.sh changes to run in CI:
- Password can come from $KIOSK_ADMIN_PASSWORD; with no TTY and no
  password it fails clearly instead of hanging on a prompt.
- Stage the repo by fetching the commit rather than `git clone --branch`,
  which fails on actions/checkout's detached HEAD; the branch name falls
  back to $GITHUB_REF_NAME, then main, and is set to track origin so
  Advanced -> Upgrade works on the installed kiosk.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Cjz8a58eB5P9sUweqd3NHm

Readme.md

@@ -96,6 +96,14 @@ Useful options (`iso/build-iso.sh --help` for all):
 | `--fully-automatic` | All of the above (needs `--username`): boot it and walk away. **Wipes a disk with no questions — label the USB stick.** |
 | `--iso PATH` | Use an ISO you already have instead of downloading. |
 
+**No Linux machine handy?** Build it on GitHub instead: **Actions → Build
+kiosk ISO → Run workflow**, pick a mode, and download the ISO from the run's
+**Artifacts** once it finishes (about 10 minutes; kept for 3 days by default).
+To pre-set the admin account (required for `fully-automatic`), first add a
+repository secret named `KIOSK_ADMIN_PASSWORD` (Settings → Secrets and
+variables → Actions). Passwords are never typed into the workflow form,
+because its inputs show up in the run log.
+
 Notes:
 - The ISO carries a copy of this checkout's current commit (uncommitted
   changes are not included).