Merge omacom/omarchy-iso#236 regional ISO builds, as an install-time choice

Every ISO bundles the cn profile; the first-screen pick decides. --region cn
only preselects China and names the artifact. The region value is cn, the cn
timezone is preselected when China is chosen, and the profile packages and
ArchLinuxCN keyring reach the target only for China.

README.md

@@ -32,6 +32,20 @@ The configurator asks for the region on its first screen. China reruns the insta
 
 Use `--dev` or `--rc` to build against those package channels. Both `--dev` and `--edge` select the dev packages from the edge mirror.
 
+### Regional builds
+
+Every ISO bundles the China profile from its runtime, so either region can be picked on the first screen. `--region cn` only preselects China there and adds a `-cn` suffix to the artifact and offline cache; the default, `--region global`, keeps the existing names. Supported country profiles use lowercase ISO 3166-1 alpha-2 codes; currently only `cn` is implemented.
+
+For an unpublished regional runtime, use matching local source and package-recipe checkouts:
+
+```bash
+./bin/omarchy-iso-make --region cn --no-boot-offer --local-source /path/to/omarchy /path/to/omarchy-pkgs
+```
+
+A China install puts each channel server's `.omarchy.cn` twin first, keeps `.omarchy.org` behind it, appends the USTC Arch mirror, and adds ArchLinuxCN with its verified keyring. USTC is rolling, not a matching stable/RC snapshot, so that last fallback's version compatibility is not guaranteed. The region architecture also stages optional new-user defaults before user creation, including deferred setup, without touching existing homes. China preselects `Asia/Shanghai` as the timezone. See `docs/regions.md` in the companion runtime checkout.
+
+Non-global cache and ISO names gain a `-cn` suffix. A runtime without the selected profile fails the build. These builds require an x86_64 Arch container environment; packaging checks on another architecture do not substitute for a fresh build, offline installation, and graphical acceptance run.
+
 ## Autoinstall
 
 The shipped ISO installs itself with no keyboard when it finds its configuration on a second drive. Attach a drive labeled `cidata` alongside the ISO and the installer copies the config off it and skips the configurator; with no such drive, nothing changes and the wizard runs as usual. No rebuild, no extra boot entry.
@@ -52,7 +66,7 @@ These are the configurator's own output files, so the way to get a starting set
 | `authorized_keys` | No | SSH public keys in sshd's own format, one per line |
 | `tailscale_authkey` | No | Tailscale auth key; the machine joins your tailnet on first boot |
 
-Both required files must be present or the installer falls back to the configurator. `user_configuration.json` may set `omarchy_install.region` to `global` (the default) or `china`, the region the configurator asks for on its first screen. Generate the password hash for `user_credentials.json` with `openssl passwd -6 "yourpassword"`.
+Both required files must be present or the installer falls back to the configurator. `user_configuration.json` may set `omarchy_install.region` to `global` (the default) or `cn`, the region the configurator asks for on its first screen. Generate the password hash for `user_credentials.json` with `openssl passwd -6 "yourpassword"`.
 
 Encryption itself is configured by the `disk_encryption` block inside `user_configuration.json` — which carries the passphrase in plaintext, so treat a drive built from an encrypted install accordingly. The flag file must match it: it drives the encrypted install's SDDM autologin and the final boot validation, not the encryption.