README: a part for users, a part for maintainers

The top is for someone who wants Omarchy: where to get the ISO and how
to check it, how to try a VM image, and autoinstall. Everything about
building, testing and publishing follows under "For maintainers", with
what is published where, how the nightly works, the fields of
latest.json and the files of a VM image.

A read against the code corrected several statements, some of them
older: the installer runs omarchy-provision-user; a defer-provisioning
marker can stand in for the credentials file; an authorized_keys file
fails the install when it holds no keys, not when its keys are bad; the
stock firewall also allows Docker's DNS; built_at is when latest.json
was written; vm-boot's needs are listed in full.

The publish job now fetches the two checksum files back as well, so
"every file of the version is compared" is exact.

.github/workflows/nightly-build.yml

@@ -261,13 +261,18 @@ jobs:
             [ "$got" = "$2" ] || { echo "::error::$1 serves $got, expected $2"; exit 1; }
             echo "ok $1"
           }
+          # Every file of the version, the checksum files too.
           for iso in "$dir"/*.iso; do
             [[ -f $iso ]] || continue
             check "$SITE/$RELEASE/${iso##*/}" "$(cut -d" " -f1 "$iso.sha256")"
+            check "$SITE/$RELEASE/${iso##*/}.sha256" "$(sha256sum "$iso.sha256" | cut -d" " -f1)"
           done
           while read -r sum name; do
             check "$SITE/$RELEASE/vm/$name" "$sum"
           done <"$dir/vm/SHA256SUMS"
+          check "$SITE/$RELEASE/vm/SHA256SUMS" "$(sha256sum "$dir/vm/SHA256SUMS" | cut -d" " -f1)"
+          published=$(find "$dir" -type f | wc -l)
+          echo "$published files published and checked"
 
       - name: Point latest.json at it
         run: |