Skip signature checks for the offline mirror

Fresh installs on real hardware failed pacstrap with "keyring is not
writable" and "required key missing from keyring". The offline repo's
SigLevel = Optional TrustAll was not the bypass it appeared to be:
Optional verifies whenever a .sig file exists — and every package in the
offline mirror ships one — while pacstrap's pacman -r relocates the
install root but not GpgDir, so verification runs against the LIVE
keyring. That silently made every install depend on archiso's boot-time
pacman-init.service having finished: fast in QEMU, minutes-or-never on
real hardware, where pacstrap then raced it and lost.

The mirror ships inside the ISO, whose integrity is already covered by
the airootfs sha512 and the ISO signature, so pacman-level signature
verification adds nothing. Set SigLevel = Never so installs never touch
the live keyring. The target still gets its own keyring via pacstrap -K
plus the archlinux-keyring/omarchy-keyring package hooks.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

configs/airootfs/usr/share/omarchy-iso/orchestrator/phases_impl.py

@@ -158,12 +158,13 @@ def _early_packages() -> list[str]:
 # configurator output.
 #
 # The live pacman keyring is deliberately NOT waited on. The offline repo is
-# SigLevel = Optional TrustAll and archinstall bootstraps with pacstrap -K,
-# which initializes an independent keyring inside the target, so no install
-# step consults the live keyring. archiso's boot-time pacman-init.service
+# SigLevel = Never (see configs/pacman-offline.conf for why that is required:
+# pacstrap verifies against the LIVE GpgDir, so anything short of Never makes
+# installs depend on archiso's boot-time pacman-init.service). That service
 # (gpg key generation + populating every keyring, Type=oneshot with no start
 # timeout) can take minutes on real hardware reading from USB — blocking on
-# it here stalled installs at 5% while it ground away in the background.
+# it here stalled installs at 5% while it ground away in the background, and
+# racing it failed pacstrap with "required key missing from keyring".
 #
 # archinstall is patched in the wrapper (omarchy-iso-install) BEFORE Python
 # imports it, so no patching happens here.

configs/pacman-offline.conf

@@ -13,6 +13,13 @@ ParallelDownloads = 5
 SigLevel    = Required DatabaseOptional
 LocalFileSigLevel = Optional
 
+# No signature checks for the offline mirror: it ships inside the ISO, whose
+# integrity is already covered by the airootfs sha512 and the ISO signature.
+# "Optional TrustAll" is NOT a bypass — Optional verifies whenever a .sig file
+# exists (they all do), and pacstrap verifies against the LIVE keyring (pacman
+# -r relocates the root but not GpgDir). That made installs depend on archiso's
+# slow boot-time pacman-init.service having finished, which stalled or failed
+# pacstrap on real hardware with "required key missing from keyring".
 [offline]
-SigLevel = Optional TrustAll
+SigLevel = Never
 Server = file:///var/cache/omarchy/mirror/offline/