Rename OEM vocabulary to provisioning (ISO)

Matches the runtime rename. The deferred-provisioning install mode replaces
'OEM' everywhere:
  omarchy_install.oem            → omarchy_install.defer_provisioning
  --oem / --oem-file             → --defer-provisioning / --defer-provisioning-file
  OMARCHY_INSTALL_OEM_FILE       → OMARCHY_INSTALL_DEFER_PROVISIONING_FILE
  cidata 'oem' marker            → 'defer-provisioning'
  /var/lib/omarchy/oem/          → /var/lib/omarchy/provisioning/
  /etc/omarchy/oem.key           → /etc/omarchy/provisioning.key
  install/oem/omarchy-oem-setup.service → install/provisioning/omarchy-provision-owner.service
  stage_oem_state phase          → stage_provisioning_state ('Staging provisioning')

Orchestrator internals (OEM_STATE_DIR, _validate_oem_state, ctx.oem, …),
the configurator, cidata-load, the dashboard phase band, the harness
(--oem → --provision), and the tests all move together.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

bin/omarchy-iso-test

@@ -14,8 +14,8 @@
 # Usage: omarchy-iso-test [release/omarchy.iso] [options]
 #
 #   --encrypt          Drive the encrypted install flow (default: unencrypted)
-#   --oem              Drive the OEM install flow: no user during install, the
-#                      first boot runs omarchy-oem-setup and creates it there
+#   --provision              Drive the deferred-provisioning install flow: no user during install, the
+#                      first boot runs omarchy-provision-owner and creates it there
 #   --reuse-base       Skip the install phase if a base image already exists
 #   --install-only     Stop after producing the installed base image
 #   --sync-omarchy DIR Push DIR's test/acceptance into the guest before running
@@ -38,7 +38,7 @@ MEMORY=8192
 INSTALL_TIMEOUT=2400
 BOOT_TIMEOUT=600
 ENCRYPT=false
-OEM=false
+PROVISION=false
 REUSE_BASE=false
 INSTALL_ONLY=false
 KEEP_RUNNING=false
@@ -53,7 +53,7 @@ GUEST_HOSTNAME="omarchy-test"
 while (($#)); do
   case "$1" in
     --encrypt) ENCRYPT=true ;;
-    --oem) OEM=true ;;
+    --provision) PROVISION=true ;;
     --reuse-base) REUSE_BASE=true ;;
     --install-only) INSTALL_ONLY=true ;;
     --keep-running) KEEP_RUNNING=true ;;
@@ -90,7 +90,7 @@ OVMF_VARS_TEMPLATE="/usr/share/edk2/x64/OVMF_VARS.4m.fd"
 
 BASE_NAME="$(basename "$ISO" .iso)"
 $ENCRYPT && BASE_NAME+="-encrypted"
-$OEM && BASE_NAME+="-oem"
+$PROVISION && BASE_NAME+="-provision"
 BASE_DIR="$REPO_DIR/test-runs/$BASE_NAME"
 RUN_DIR="$BASE_DIR/runs/$(date +%Y%m%d-%H%M%S)"
 BASE_DISK="$BASE_DIR/base.qcow2"
@@ -606,12 +606,12 @@ audio-panel|meta_l-ctrl-a|omarchy-keyboard-panel|omarchy.audio'
 drive_configurator() {
   log "Driving the installer wizard"
 
-  # Keyboard is the first screen. Ctrl+C there is the hidden entry into OEM
+  # Keyboard is the first screen. Ctrl+C there is the hidden entry into deferred provisioning
   # mode; a normal install just selects the layout.
   wait_for_screen "keyboard layout" 300
   capture_console "success-installer-01-keyboard-layout"
 
-  if $OEM; then
+  if $PROVISION; then
     press ctrl-c # arm "prepare for another owner"
     wait_for_screen "another owner" 30
     capture_console "success-installer-02-prepare-confirm"
@@ -699,30 +699,30 @@ drive_configurator() {
   capture_console "success-installer-14-install-started"
 }
 
-# The OEM first boot runs the user form on tty1 (omarchy-oem-setup) before
-# SDDM. Encrypted OEM installs auto-unlock from the staged keyfile, so there
+# The deferred-provisioning first boot runs the user form on tty1 (omarchy-provision-owner) before
+# SDDM. Encrypted deferred-provisioning installs auto-unlock from the staged keyfile, so there
 # is no LUKS prompt to answer here either way.
-drive_oem_setup() {
-  log "Driving the OEM first-boot setup"
+drive_provision_owner() {
+  log "Driving the deferred-provisioning first-boot setup"
 
-  # OEM defers the keyboard step to first boot; it comes before the user form.
+  # Deferred provisioning defers the keyboard step to first boot; it comes before the user form.
   # Pick English (UK) (one row above the preselected English (US)) so the
   # verifier can prove the deferred step applied a non-default layout — UK
   # leaves every letter identical to US, so the typed password (sent as raw
   # keycodes) still matches the literal one the harness pipes to sudo.
   wait_for_screen "keyboard layout" 600
   press up
-  capture_console "success-oem-01-keyboard-layout-uk"
+  capture_console "success-provision-01-keyboard-layout-uk"
   press ret
 
   wait_for_screen "Username" 120
-  capture_console "success-oem-02-username"
+  capture_console "success-provision-02-username"
   type_text "$GUEST_USER"
   press ret
 
   wait_for_screen "Password" 60
   type_text "$GUEST_PASSWORD"
-  capture_console "success-oem-03-password"
+  capture_console "success-provision-03-password"
   press ret
 
   wait_for_screen "Conf *irm" 60
@@ -740,16 +740,16 @@ drive_oem_setup() {
   type_text "test"
   press shift-apostrophe
   type_text "omarchy.org"
-  capture_console "success-oem-04-email"
+  capture_console "success-provision-04-email"
   press ret
 
   wait_for_screen "look right" 60
-  capture_console "success-oem-05-review"
+  capture_console "success-provision-05-review"
   press ret
 
   # Finalization (offline Node unpack, LUKS re-key on encrypted installs)
   # runs before SDDM appears.
-  capture_console "success-oem-06-finalizing"
+  capture_console "success-provision-06-finalizing"
 }
 
 wait_for_install() {
@@ -952,30 +952,30 @@ install_phase() {
   drive_configurator
   wait_for_install
 
-  if $OEM; then
-    drive_oem_setup
+  if $PROVISION; then
+    drive_provision_owner
   elif $ENCRYPT; then
     unlock_luks
   fi
   bootstrap_ssh
 
   # SSH can come up (console bootstrap logs in on a spare TTY) while
-  # omarchy-oem-setup is still finalizing the user and re-keying LUKS. Saving
+  # omarchy-provision-owner is still finalizing the user and re-keying LUKS. Saving
   # the base mid-finalization produces a flaky image, so wait for the pending
   # flag to clear before powering off.
-  if $OEM; then
-    log "Waiting for OEM first-boot setup to finish"
+  if $PROVISION; then
+    log "Waiting for provisioning first-boot setup to finish"
     local waited=0
-    while ssh_guest "test -f /var/lib/omarchy/oem/pending" 2>/dev/null; do
+    while ssh_guest "test -f /var/lib/omarchy/provisioning/pending" 2>/dev/null; do
       if ((waited >= 900)); then
-        capture_console "failure-oem-finalization-timeout"
-        echo "Timed out waiting for OEM first-boot setup to complete" >&2
+        capture_console "failure-provision-finalization-timeout"
+        echo "Timed out waiting for provisioning first-boot setup to complete" >&2
         return 1
       fi
       sleep 10
       ((waited += 10))
     done
-    capture_console "success-oem-06-setup-complete"
+    capture_console "success-provision-06-setup-complete"
   fi
 
   ssh_guest "echo $GUEST_PASSWORD | sudo -S cat /var/log/omarchy-install-timing.json 2>/dev/null" \