Merge omacom/omarchy-iso#236 regional ISO builds, as an install-time choice

Every ISO bundles the cn profile; the first-screen pick decides. --region cn
only preselects China and names the artifact. The region value is cn, the cn
timezone is preselected when China is chosen, and the profile packages and
ArchLinuxCN keyring reach the target only for China.

configs/airootfs/usr/share/omarchy-iso/orchestrator/context.py

@@ -67,8 +67,8 @@ class InstallContext:
 
         # Autoinstall configs written before regions existed install Global.
         region = omarchy_install.get("region", "global")
-        if region not in ("global", "china"):
-            raise RuntimeError(f"omarchy_install.region must be global or china, not {region!r}")
+        if region not in ("global", "cn"):
+            raise RuntimeError(f"omarchy_install.region must be global or cn, not {region!r}")
         omarchy_install["region"] = region
 
         if creds_path.exists():

configs/airootfs/usr/share/omarchy-iso/orchestrator/phases_impl.py

@@ -39,6 +39,32 @@ from .keyboard import configure_keyboard
 from .ui import error, info
 
 
+ISO_REGION_PAYLOAD = Path("/usr/share/omarchy-iso/region")
+
+
+def _region_packages(ctx: InstallContext) -> list[str]:
+    if ctx.omarchy_install["region"] != "cn":
+        return []
+    lines = (ISO_REGION_PAYLOAD / "packages").read_text().splitlines()
+    return [s for s in (raw.strip() for raw in lines) if s and not s.startswith("#")]
+
+
+def _stage_region_defaults(ctx: InstallContext) -> None:
+    """Seed the target before useradd, including deferred first-boot users.
+
+    Region is a bootstrap default, not a locale or a user-level policy.
+    Existing home directories are never rewritten by this step.
+    """
+    region = ctx.omarchy_install["region"]
+    skel = ISO_REGION_PAYLOAD / "skel"
+    if region == "cn" and skel.is_dir():
+        shutil.copytree(skel, ctx.target / "etc/skel", dirs_exist_ok=True)
+    marker = ctx.target / "etc/omarchy/region"
+    marker.parent.mkdir(parents=True, exist_ok=True)
+    marker.write_text(region + "\n")
+    marker.chmod(0o644)
+
+
 # Package targets are written by builder/build-iso.sh. Stable ISOs use the
 # stable package names, while dev/local-source ISOs install the dev package
 # names explicitly instead of relying on provides=omarchy resolution.
@@ -286,6 +312,7 @@ def arch_install_system(ctx: InstallContext) -> None:
             _install_early_packages(installer)
             _configure_limine_boot(ctx, installer, config)
 
+            _stage_region_defaults(ctx)
             info("› creating user (with /etc/skel populated)")
             if config.auth_config and config.auth_config.users:
                 installer.create_users(config.auth_config.users)
@@ -746,6 +773,7 @@ def _runtime_package_list(ctx: InstallContext) -> list[str]:
             continue
         if s not in already_installed and s not in pkgs:
             pkgs.append(s)
+    pkgs += [p for p in _region_packages(ctx) if p not in pkgs]
     # Local builds live only in this ISO's mirror; a later region switch could not fetch them.
     if PINNED_PACKAGES.exists():
         pkgs += [p for p in PINNED_PACKAGES.read_text().split() if p not in already_installed and p not in pkgs]
@@ -1138,6 +1166,13 @@ def _run_target_setup_command(ctx: InstallContext, cmd: list[str], *, user: str
 
 
 def run_system_finalizer(ctx: InstallContext) -> None:
+    # The runtime package transaction has installed the regional keyring from
+    # the ISO. Initialize the target's trust database before enabling the online
+    # community repository; the build container's GPG state is not inherited.
+    if ctx.omarchy_install["region"] == "cn":
+        _run_target_setup_command(ctx, ["pacman-key", "--init"])
+        _run_target_setup_command(ctx, ["pacman-key", "--populate", "archlinux", "archlinuxcn"])
+
     if ctx.defer_provisioning:
         cmd = ["/usr/bin/omarchy-apply-system", "--defer-provisioning", "--first-install"]
     else: