ISO: add --offline bundle so the kiosk installs with no internet

`iso/build-iso.sh --offline` (and the workflow's new `offline` box, on by
default) adds ~420 MB to the ISO and copies it to /opt/kiosk-offline:

- apt/: local repository with every package install.sh's provisioning
  and the CUPS addon install ask for, NodeSource's nodejs, and all
  dependencies a fresh server install doesn't already have. Resolved
  against the source ISO's own package manifest via a synthesized dpkg
  status (iso/offline/fake-dpkg-status.py), so apt downloads only what's
  missing and makes the same virtual/alternative choices as the target.
- npm/: prebuilt kiosk-app (Electron 42, binary included - it no longer
  downloads at npm install time) and Web UI node_modules.

On first boot, kiosk-firstboot installs online as before when there's
internet; with none it waits KIOSK_OFFLINE_WAIT (90s), then runs
`kiosk-offline-apt on` (apt.conf.d drop-in: bundle is the ONLY source)
and turns it off again afterwards. install.sh notices offline mode via
offline_mode_active (lib/config.sh) and installs nodejs from the bundle
and unpacks prebuilt node_modules instead of npm install.

Package lists moved into PROVISION_APT_PACKAGES /
PROVISION_INTEL_APT_PACKAGES / CUPS_APT_PACKAGES so the bundler reads
the same lists install.sh installs from.

Tested: built against the 26.04.1 ISO, then in a network-less chroot of
the ISO's own server filesystem installed every package set, ran
provision_create_kiosk_user/install_nodejs/install_app and
webui_install_app_files in offline mode (Electron runs, no missing
libraries, chrome-sandbox setuid), and ran kiosk-firstboot through the
offline switch with a stub install.sh.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Cjz8a58eB5P9sUweqd3NHm

Readme.md

@@ -94,8 +94,46 @@ Useful options (`iso/build-iso.sh --help` for all):
 | `--auto-network` / `--auto-storage` | Skip the network screen (DHCP on ethernet) / wipe the largest disk without asking. |
 | `--no-confirm` | Skip the "Continue with autoinstall?" prompt at boot. |
 | `--fully-automatic` | All of the above (needs `--username`): boot it and walk away. **Wipes a disk with no questions — label the USB stick.** |
+| `--offline` | Bundle everything the kiosk install downloads, so it works with **no internet** (see below). |
 | `--iso PATH` | Use an ISO you already have instead of downloading. |
 
+### Offline installs (`--offline`)
+
+```bash
+sudo apt install apt-utils python3 gnupg ubuntu-keyring   # once, on top of the tools above
+iso/build-iso.sh --offline
+# -> iso/build/ubuntu-26.04.x-kiosk-offline-amd64.iso (~3.2 GB)
+```
+
+This adds a ~420 MB bundle to the ISO:
+- Every Ubuntu package the kiosk install and the **CUPS printing addon**
+  need (all printer drivers included), with their dependencies, as a local
+  package repository.
+- Node.js 22 (NodeSource).
+- Prebuilt Electron and Web UI modules.
+
+On first boot it still installs online when there's internet. With none,
+it waits 90 seconds and then installs entirely from the bundle. The bundle
+stays on the kiosk at `/opt/kiosk-offline`, so CUPS can be added later
+with no internet too:
+
+```bash
+sudo kiosk-offline-apt on      # apt uses the bundle only
+./install.sh                   # Addons -> CUPS Printing
+sudo kiosk-offline-apt off     # back to normal updates
+```
+
+Notes:
+- Build it on an **amd64** Ubuntu/Debian machine, or let the GitHub
+  workflow do it (its `offline` box is ticked by default). Rebuilds are
+  quick because downloads are cached in `iso/build/offline-cache`.
+- Bundled versions are whatever was current when the ISO was built.
+  Once the kiosk is online, normal updates and Advanced → Upgrade bring it
+  current.
+- Addons that download their own software (LMS/Squeezelite, Tailscale,
+  Netbird, Asterisk Intercom, VNC) still need internet.
+- `sudo rm -rf /opt/kiosk-offline` frees the space if you don't need it.
+
 **No Linux machine handy?** Build it on GitHub instead: **Actions → Build
 kiosk ISO → Run workflow**, pick a mode, and download the ISO from the run's
 **Artifacts** once it finishes (about 10 minutes; kept for 3 days by default).
@@ -107,9 +145,10 @@ because its inputs show up in the run log.
 Notes:
 - The ISO carries a copy of this checkout's current commit (uncommitted
   changes are not included).
-- The kiosk machine still needs internet on first boot (packages, Node.js,
-  Electron). If there's none, the console waits for it and offers a shell to
-  fix networking (`/etc/netplan/*.yaml`, then `sudo netplan apply`).
+- Without `--offline`, the kiosk machine needs internet on first boot
+  (packages, Node.js, Electron). If there's none, the console waits for it
+  and offers a shell to fix networking (`/etc/netplan/*.yaml`, then
+  `sudo netplan apply`).
 - A failed or interrupted first-boot install runs again on the next boot, or
   now with `sudo systemctl start kiosk-firstboot`. Its log is
   `/var/lib/kiosk-firstboot/install.log`.
@@ -120,7 +159,7 @@ Notes:
 
 If the kiosk machine can't reach GitHub directly (no browser, restrictive proxy, or you just prefer to grab the script on another computer and carry it over via USB), download it ahead of time instead of using the `curl`/`wget` one-liner above.
 
-> **Note:** This only avoids needing internet access *to fetch the script*. The installer itself still requires the kiosk machine to have internet access while it runs — it uses `apt` to install packages, pulls Node.js from NodeSource, and runs `npm install` to fetch Electron (~120MB). There is currently no fully air-gapped/offline package bundle.
+> **Note:** This only avoids needing internet access *to fetch the script*. For a truly offline install, use the [All-in-One Install ISO](#all-in-one-install-iso-ubuntu-server-2604--kiosk) built with `--offline` instead. The installer itself still requires the kiosk machine to have internet access while it runs — it uses `apt` to install packages, pulls Node.js from NodeSource, and runs `npm install` to fetch Electron (~120MB). There is currently no fully air-gapped/offline package bundle.
 
 **On a machine with internet access:**