Add all-in-one Ubuntu Server 26.04 + kiosk install ISO builder

iso/build-iso.sh remasters the official 26.04.x live-server ISO (downloaded
and checksum-verified, or --iso PATH) with xorriso, replaying its BIOS/UEFI
boot records unchanged. It adds:

- /autoinstall.yaml: Subiquity autoinstall that answers locale/keyboard/SSH
  and by default leaves only network, storage and identity interactive
  (--username/--auto-storage/--auto-network/--no-confirm/--fully-automatic
  make those automatic too). late-commands copy the repo (a clone of the
  current HEAD) to /opt/ubuntu-based-kiosk and enable a first-boot service.
- iso/firstboot/kiosk-firstboot(.service): on first boot, takes tty1, waits
  for cloud-init and internet, copies the repo to the admin user's home and
  runs ./install.sh as that user with temporary passwordless sudo (removed
  on every exit path). Failed/interrupted installs re-run next boot.

install.sh hooks for this:
- KIOSK_UNATTENDED=1 makes ask_yes_no take each prompt's default and skips
  the Core Settings menu (--unattended).
- KIOSK_PROVISION_DONE_MARKER is touched by provision_finish before the
  reboot prompt, so the caller can tell a finished install from an
  interrupted one.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Cjz8a58eB5P9sUweqd3NHm

lib/menu.sh

@@ -118,6 +118,16 @@ ask_yes_no() {
     local default="${2:-n}"
     local answer
 
+    # Unattended first-boot install (iso/ - KIOSK_UNATTENDED=1 in
+    # /etc/kiosk-firstboot.conf): nobody is at the keyboard, so take the
+    # default every prompt already offers and echo it so the log still
+    # shows what was decided.
+    if [[ "${KIOSK_UNATTENDED:-0}" == "1" ]]; then
+        echo "$prompt (y/n) [$default]: $default (unattended)"
+        validate_yes_no "$default"
+        return
+    fi
+
     while true; do
         read -r -p "$prompt (y/n) [$default]: " answer
         answer="${answer:-$default}"