ISO: add --offline bundle so the kiosk installs with no internet

`iso/build-iso.sh --offline` (and the workflow's new `offline` box, on by
default) adds ~420 MB to the ISO and copies it to /opt/kiosk-offline:

- apt/: local repository with every package install.sh's provisioning
  and the CUPS addon install ask for, NodeSource's nodejs, and all
  dependencies a fresh server install doesn't already have. Resolved
  against the source ISO's own package manifest via a synthesized dpkg
  status (iso/offline/fake-dpkg-status.py), so apt downloads only what's
  missing and makes the same virtual/alternative choices as the target.
- npm/: prebuilt kiosk-app (Electron 42, binary included - it no longer
  downloads at npm install time) and Web UI node_modules.

On first boot, kiosk-firstboot installs online as before when there's
internet; with none it waits KIOSK_OFFLINE_WAIT (90s), then runs
`kiosk-offline-apt on` (apt.conf.d drop-in: bundle is the ONLY source)
and turns it off again afterwards. install.sh notices offline mode via
offline_mode_active (lib/config.sh) and installs nodejs from the bundle
and unpacks prebuilt node_modules instead of npm install.

Package lists moved into PROVISION_APT_PACKAGES /
PROVISION_INTEL_APT_PACKAGES / CUPS_APT_PACKAGES so the bundler reads
the same lists install.sh installs from.

Tested: built against the 26.04.1 ISO, then in a network-less chroot of
the ISO's own server filesystem installed every package set, ran
provision_create_kiosk_user/install_nodejs/install_app and
webui_install_app_files in offline mode (Electron runs, no missing
libraries, chrome-sandbox setuid), and ran kiosk-firstboot through the
offline switch with a stub install.sh.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Cjz8a58eB5P9sUweqd3NHm

.github/workflows/build-iso.yml

@@ -39,6 +39,13 @@ on:
         description: Optional SSH public key for the admin user (ssh-ed25519 AAAA...)
         type: string
         default: ""
+      offline:
+        description: >-
+          Bundle everything install.sh downloads (~420 MB: all packages incl.
+          CUPS printing, Node.js, Electron) so the kiosk installs with no
+          internet on first boot.
+        type: boolean
+        default: true
       retention_days:
         description: Days to keep the ISO artifact
         type: number
@@ -57,11 +64,12 @@ jobs:
       - name: Install build tools
         run: |
           sudo apt-get update -q
-          sudo apt-get install -y -q xorriso
+          sudo apt-get install -y -q xorriso apt-utils ubuntu-keyring
 
       - name: Build ISO
         env:
           MODE: ${{ inputs.mode }}
+          OFFLINE: ${{ inputs.offline }}
           ADMIN_USERNAME: ${{ inputs.username }}
           ADMIN_HOSTNAME: ${{ inputs.hostname }}
           SSH_PUBLIC_KEY: ${{ inputs.ssh_public_key }}
@@ -84,19 +92,22 @@ jobs:
             printf '%s\n' "$SSH_PUBLIC_KEY" > "$RUNNER_TEMP/ssh_key.pub"
             args+=(--ssh-key "$RUNNER_TEMP/ssh_key.pub")
           fi
+          [[ "$OFFLINE" == "true" ]] && args+=(--offline)
           iso/build-iso.sh "${args[@]}"
           # Name the file after the Ubuntu point release the script picked.
           src="$(find iso/build/cache -name "*.iso" -print -quit)"
-          name="$(basename "$src" .iso | sed 's/-live-server/-kiosk/')-${MODE}-${GITHUB_SHA::7}.iso"
+          kind="kiosk"; [[ "$OFFLINE" == "true" ]] && kind="kiosk-offline"
+          name="$(basename "$src" .iso | sed "s/-live-server/-$kind/")-${MODE}-${GITHUB_SHA::7}.iso"
           mv "$RUNNER_TEMP/iso/ubuntu-kiosk-amd64.iso" "$RUNNER_TEMP/iso/$name"
           # Free the ~3 GB source ISO before the upload step needs scratch space.
-          rm -rf iso/build/cache
+          rm -rf iso/build/cache iso/build/offline-cache
           (cd "$RUNNER_TEMP/iso" && sha256sum "$name" > "$name.sha256")
           echo "ISO_NAME=$name" >> "$GITHUB_ENV"
           {
             echo "### $name"
             echo
             echo "- Mode: \`$MODE\`"
+            echo "- Offline bundle: $([[ "$OFFLINE" == "true" ]] && echo "yes - installs with no internet" || echo "no - kiosk needs internet on first boot")"
             echo "- Admin user: ${ADMIN_USERNAME:-chosen during install}"
             echo "- Built from: \`${GITHUB_REF_NAME}\` @ \`${GITHUB_SHA::7}\`"
             echo "- SHA-256: \`$(cut -d' ' -f1 "$RUNNER_TEMP/iso/$name.sha256")\`"