Add all-in-one Ubuntu Server 26.04 + kiosk install ISO builder

iso/build-iso.sh remasters the official 26.04.x live-server ISO (downloaded
and checksum-verified, or --iso PATH) with xorriso, replaying its BIOS/UEFI
boot records unchanged. It adds:

- /autoinstall.yaml: Subiquity autoinstall that answers locale/keyboard/SSH
  and by default leaves only network, storage and identity interactive
  (--username/--auto-storage/--auto-network/--no-confirm/--fully-automatic
  make those automatic too). late-commands copy the repo (a clone of the
  current HEAD) to /opt/ubuntu-based-kiosk and enable a first-boot service.
- iso/firstboot/kiosk-firstboot(.service): on first boot, takes tty1, waits
  for cloud-init and internet, copies the repo to the admin user's home and
  runs ./install.sh as that user with temporary passwordless sudo (removed
  on every exit path). Failed/interrupted installs re-run next boot.

install.sh hooks for this:
- KIOSK_UNATTENDED=1 makes ask_yes_no take each prompt's default and skips
  the Core Settings menu (--unattended).
- KIOSK_PROVISION_DONE_MARKER is touched by provision_finish before the
  reboot prompt, so the caller can tell a finished install from an
  interrupted one.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Cjz8a58eB5P9sUweqd3NHm

Readme.md

@@ -61,6 +61,53 @@ The installer will guide you through configuration during setup.
 
 ---
 
+## All-in-One Install ISO (Ubuntu Server 26.04 + Kiosk)
+
+Instead of installing Ubuntu Server and then running the script, build a
+single ISO that does both: it installs Ubuntu Server 26.04, and on the first
+boot of the installed system it runs `./install.sh` automatically on the
+console.
+
+```bash
+sudo apt install xorriso curl git openssl
+git clone https://github.com/outis1one/ubuntu-based-kiosk.git
+cd ubuntu-based-kiosk
+iso/build-iso.sh            # downloads + verifies the latest 26.04.x server ISO
+# -> iso/build/ubuntu-26.04.x-kiosk-amd64.iso
+sudo dd if=iso/build/ubuntu-26.04.*-kiosk-amd64.iso of=/dev/sdX bs=4M status=progress oflag=sync
+```
+
+By default the installer only asks for **network** (WiFi works here),
+**disk**, and your **admin username/password** — language, keyboard and the
+SSH server are answered for you. On first boot, `install.sh` runs
+interactively on the screen, exactly like a manual install. The repo ends up
+at `~/ubuntu-based-kiosk` for the admin user, so `./install.sh` and
+Advanced → Upgrade work afterwards as usual.
+
+Useful options (`iso/build-iso.sh --help` for all):
+
+| Option | Effect |
+|---|---|
+| `--unattended` | First-boot install takes every default with no prompts (skips the Core Settings menu) and reboots into the kiosk. Set sites afterwards in the Web UI (`http://<ip>:8090`) or `./install.sh`. |
+| `--username NAME [--password PASS]` | Pre-set the admin account (password is prompted for if omitted; only a hash goes on the ISO). Not `kiosk`. |
+| `--hostname`, `--ssh-key FILE`, `--locale`, `--keyboard` | Pre-set those. |
+| `--auto-network` / `--auto-storage` | Skip the network screen (DHCP on ethernet) / wipe the largest disk without asking. |
+| `--no-confirm` | Skip the "Continue with autoinstall?" prompt at boot. |
+| `--fully-automatic` | All of the above (needs `--username`): boot it and walk away. **Wipes a disk with no questions — label the USB stick.** |
+| `--iso PATH` | Use an ISO you already have instead of downloading. |
+
+Notes:
+- The ISO carries a copy of this checkout's current commit (uncommitted
+  changes are not included).
+- The kiosk machine still needs internet on first boot (packages, Node.js,
+  Electron). If there's none, the console waits for it and offers a shell to
+  fix networking (`/etc/netplan/*.yaml`, then `sudo netplan apply`).
+- A failed or interrupted first-boot install runs again on the next boot, or
+  now with `sudo systemctl start kiosk-firstboot`. Its log is
+  `/var/lib/kiosk-firstboot/install.log`.
+
+---
+
 ## Offline / Air-Gapped Download
 
 If the kiosk machine can't reach GitHub directly (no browser, restrictive proxy, or you just prefer to grab the script on another computer and carry it over via USB), download it ahead of time instead of using the `curl`/`wget` one-liner above.