Add all-in-one Ubuntu Server 26.04 + kiosk install ISO builder

iso/build-iso.sh remasters the official 26.04.x live-server ISO (downloaded
and checksum-verified, or --iso PATH) with xorriso, replaying its BIOS/UEFI
boot records unchanged. It adds:

- /autoinstall.yaml: Subiquity autoinstall that answers locale/keyboard/SSH
  and by default leaves only network, storage and identity interactive
  (--username/--auto-storage/--auto-network/--no-confirm/--fully-automatic
  make those automatic too). late-commands copy the repo (a clone of the
  current HEAD) to /opt/ubuntu-based-kiosk and enable a first-boot service.
- iso/firstboot/kiosk-firstboot(.service): on first boot, takes tty1, waits
  for cloud-init and internet, copies the repo to the admin user's home and
  runs ./install.sh as that user with temporary passwordless sudo (removed
  on every exit path). Failed/interrupted installs re-run next boot.

install.sh hooks for this:
- KIOSK_UNATTENDED=1 makes ask_yes_no take each prompt's default and skips
  the Core Settings menu (--unattended).
- KIOSK_PROVISION_DONE_MARKER is touched by provision_finish before the
  reboot prompt, so the caller can tell a finished install from an
  interrupted one.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Cjz8a58eB5P9sUweqd3NHm

iso/firstboot/kiosk-firstboot.service

@@ -0,0 +1,33 @@
+# Installed by the custom ISO (iso/build-iso.sh) and enabled from its
+# autoinstall late-commands. Runs install.sh once, on tty1, the first
+# time the freshly installed system boots - takes tty1 over from getty
+# so an interactive install has a keyboard and screen, then hands tty1
+# back. /var/lib/kiosk-firstboot/pending is removed once the install
+# finishes, so this is a no-op on every boot after that; an interrupted
+# or failed install leaves it in place and simply runs again next boot.
+[Unit]
+Description=Ubuntu Based Kiosk first-boot install
+After=network-online.target systemd-user-sessions.service cloud-final.service plymouth-quit-wait.service
+Wants=network-online.target
+Before=getty@tty1.service
+Conflicts=getty@tty1.service
+ConditionPathExists=/var/lib/kiosk-firstboot/pending
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/kiosk-firstboot
+# Belt and braces for the temporary sudoers/apt drop-ins when install.sh
+# reboots out from under the script (its own EXIT trap normally does this).
+ExecStopPost=/usr/local/sbin/kiosk-firstboot --cleanup
+StandardInput=tty-force
+StandardOutput=tty
+StandardError=tty
+TTYPath=/dev/tty1
+TTYReset=yes
+TTYVHangup=yes
+TimeoutStartSec=infinity
+TimeoutStopSec=30
+KillMode=mixed
+
+[Install]
+WantedBy=multi-user.target