Refactor ISO build for the package-backed install flow

The ISO no longer carries a cp -r'd copy of the omarchy git checkout
into /root/omarchy and the target /home/$user/.local/share/omarchy.
Instead it builds omarchy-installer + omarchy-settings + omarchy +
omarchy-limine from mounted source trees (${OMARCHY_INSTALLER_PATH:-
../omarchy-installer} and ${OMARCHY_PKGS_PATH:-../omarchy-pkgs}),
drops them in the offline mirror, and pacstraps omarchy-installer
during the target install — which deps-in the other three.

- builder/build-omarchy-packages.sh: new. Builds the four packages
  inside the ISO build container using each PKGBUILD's OMARCHY_SRC
  override (introduced in Chunk 2). Creates a 'builder' user because
  makepkg refuses to run as root. Drops the resulting .pkg.tar.zst
  files into the offline-mirror directory.

- builder/build-iso.sh: drop the git clone / -v omarchy mount path;
  call build-omarchy-packages.sh first; filter out the locally-built
  package names from the rest-of-mirror download so we don't try to
  fetch them from the network mirror.

- configs/airootfs/root/.automated_script.sh: replace the install_omarchy
  cp-and-source dance with 'arch-chroot pacman -S omarchy-installer'
  followed by 'OMARCHY_INSTALL_MODE=offline omarchy-install'. Drop the
  big chown/chmod block that was setting up the cloned tree.
  use_omarchy_helpers extracts the installer's helpers/ tree directly
  from the offline-mirror's omarchy-installer-*.pkg.tar.zst so the live
  ISO has access to gum-styled logging before pacstrap.

- bin/omarchy-iso-make: always mount omarchy-installer and omarchy-pkgs
  (paths configurable via OMARCHY_INSTALLER_PATH / OMARCHY_PKGS_PATH;
  default to ../omarchy-installer and ../omarchy-pkgs). --local-source
  is now a back-compat no-op.

configs/airootfs/root/.automated_script.sh

@@ -2,11 +2,25 @@
 set -euo pipefail
 
 use_omarchy_helpers() {
-  export OMARCHY_PATH="/root/omarchy"
-  export OMARCHY_INSTALL="/root/omarchy/install"
-  export OMARCHY_INSTALL_LOG_FILE="/var/log/omarchy-install.log"
+  # The omarchy-installer package isn't installed in the live ISO environment;
+  # only mounted as part of the offline mirror. Source the helpers we still
+  # need (gum styling, run_logged) from the package's install/ tree by
+  # pulling it out of the offline mirror tarball into /tmp.
   export OMARCHY_MIRROR="$(cat /root/omarchy_mirror)"
-  source /root/omarchy/install/helpers/all.sh
+  if [[ ! -d /tmp/omarchy-installer-iso ]]; then
+    local pkg
+    pkg=$(ls /var/cache/omarchy/mirror/offline/omarchy-installer-*.pkg.tar.zst 2>/dev/null | head -1)
+    if [[ -z $pkg ]]; then
+      echo "ERROR: omarchy-installer package not found in offline mirror" >&2
+      exit 1
+    fi
+    mkdir -p /tmp/omarchy-installer-iso
+    bsdtar -xf "$pkg" -C /tmp/omarchy-installer-iso usr/share/omarchy
+  fi
+  export OMARCHY_PATH=/tmp/omarchy-installer-iso/usr/share/omarchy
+  export OMARCHY_INSTALL=$OMARCHY_PATH/install
+  export OMARCHY_INSTALL_LOG_FILE=/var/log/omarchy-install.log
+  source "$OMARCHY_INSTALL/helpers/all.sh"
 }
 
 run_configurator() {
@@ -21,10 +35,8 @@ install_arch() {
   echo
 
   touch /var/log/omarchy-install.log
-
   start_log_output
 
-  # Set CURRENT_SCRIPT for the trap to display better when nothing is returned for some reason
   CURRENT_SCRIPT="install_base_system"
   install_base_system > >(sed -u 's/\x1b\[[0-9;]*[a-zA-Z]//g' >>/var/log/omarchy-install.log) 2>&1
   unset CURRENT_SCRIPT
@@ -32,39 +44,31 @@ install_arch() {
 }
 
 install_omarchy() {
-  chroot_bash -lc "sudo pacman -S --noconfirm --needed gum" >/dev/null
-  chroot_bash -lc "source /home/$OMARCHY_USER/.local/share/omarchy/install.sh || bash"
+  # Install the omarchy meta-packages from the offline mirror into the target.
+  # omarchy-installer's depends pull in omarchy + omarchy-settings + omarchy-limine.
+  arch-chroot /mnt pacman -S --noconfirm --needed omarchy-installer
+
+  # Run the installer's offline path. omarchy-install execs /usr/share/omarchy/
+  # install.sh; OMARCHY_INSTALL_MODE=offline tells it to skip first-run-mode
+  # the right way for a chroot install.
+  chroot_run_as_user "OMARCHY_INSTALL_MODE=offline omarchy-install"
 
   configure_login_for_unencrypted_install
 
-  # Reboot if requested by installer
   if [[ -f /mnt/var/tmp/omarchy-install-completed ]]; then
     reboot
   fi
 }
 
-# Set Tokyo Night color scheme for the terminal
+# Tokyo Night palette so the live VT matches the installed look.
 set_tokyo_night_colors() {
-  if [[ $(tty) == "/dev/tty"* ]]; then
-    # Tokyo Night color palette
-    echo -en "\e]P01a1b26" # black (background)
-    echo -en "\e]P1f7768e" # red
-    echo -en "\e]P29ece6a" # green
-    echo -en "\e]P3e0af68" # yellow
-    echo -en "\e]P47aa2f7" # blue
-    echo -en "\e]P5bb9af7" # magenta
-    echo -en "\e]P67dcfff" # cyan
-    echo -en "\e]P7a9b1d6" # white
-    echo -en "\e]P8414868" # bright black
-    echo -en "\e]P9f7768e" # bright red
-    echo -en "\e]PA9ece6a" # bright green
-    echo -en "\e]PBe0af68" # bright yellow
-    echo -en "\e]PC7aa2f7" # bright blue
-    echo -en "\e]PDbb9af7" # bright magenta
-    echo -en "\e]PE7dcfff" # bright cyan
-    echo -en "\e]PFc0caf5" # bright white (foreground)
-
-    # Set default foreground and background
+  if [[ $(tty) == /dev/tty* ]]; then
+    echo -en "\e]P01a1b26"; echo -en "\e]P1f7768e"; echo -en "\e]P29ece6a"
+    echo -en "\e]P3e0af68"; echo -en "\e]P47aa2f7"; echo -en "\e]P5bb9af7"
+    echo -en "\e]P67dcfff"; echo -en "\e]P7a9b1d6"; echo -en "\e]P8414868"
+    echo -en "\e]P9f7768e"; echo -en "\e]PA9ece6a"; echo -en "\e]PBe0af68"
+    echo -en "\e]PC7aa2f7"; echo -en "\e]PDbb9af7"; echo -en "\e]PE7dcfff"
+    echo -en "\e]PFc0caf5"
     echo -en "\033[0m"
     clear
   fi
@@ -76,48 +80,28 @@ install_disk() {
 
 cleanup_install_disk() {
   local disk="$1"
-
-  if [[ -z "$disk" || ! -b "$disk" ]]; then
-    echo "Could not determine install disk for cleanup" >&2
-    return 1
-  fi
+  [[ -n $disk && -b $disk ]] || { echo "Could not determine install disk for cleanup" >&2; return 1; }
 
   echo "Cleaning up existing holders on install disk: $disk"
-
-  # Ensure that no mounts exist from past install attempts.
   findmnt -R /mnt >/dev/null && umount -R /mnt || true
 
-  # Turn off swap and unmount anything backed by the selected disk, including
-  # device-mapper children from a previous install. Active LVM/swap holders can
-  # prevent the kernel from re-reading the partition table after archinstall
-  # wipes and recreates it.
   while read -r dev; do
-    [[ -b "$dev" ]] || continue
-
+    [[ -b $dev ]] || continue
     swapoff "$dev" 2>/dev/null || true
-
     while read -r target; do
-      [[ -n "$target" ]] || continue
-      umount "$target" 2>/dev/null || true
+      [[ -n $target ]] && umount "$target" 2>/dev/null || true
     done < <(findmnt -rn -S "$dev" -o TARGET 2>/dev/null || true)
   done < <(lsblk -rnpo PATH "$disk")
 
-  # Deactivate any LVM volume groups whose physical volumes live on the selected
-  # disk. This is the common case when replacing Fedora/Alma/RHEL installs.
   while read -r dev type; do
-    [[ "$type" == "disk" || "$type" == "part" || "$type" == "crypt" ]] || continue
-
+    [[ $type == disk || $type == part || $type == crypt ]] || continue
     while read -r vg; do
-      [[ -n "$vg" ]] || continue
-      vgchange -an "$vg" 2>/dev/null || true
+      [[ -n $vg ]] && vgchange -an "$vg" 2>/dev/null || true
     done < <(pvs --noheadings -o vg_name "$dev" 2>/dev/null | awk '{$1=$1; print}' | sort -u)
   done < <(lsblk -rnpo PATH,TYPE "$disk")
 
-  # Close any LUKS mappings stacked on the selected disk after filesystems and
-  # swap have been released.
   while read -r dev type; do
-    [[ "$type" == "crypt" ]] || continue
-    cryptsetup close "$dev" 2>/dev/null || true
+    [[ $type == crypt ]] && cryptsetup close "$dev" 2>/dev/null || true
   done < <(lsblk -rnpo PATH,TYPE "$disk")
 
   blockdev --flushbufs "$disk" 2>/dev/null || true
@@ -126,31 +110,21 @@ cleanup_install_disk() {
 }
 
 install_base_system() {
-  # Initialize and populate the keyring
   pacman-key --init
   pacman-key --populate archlinux
   pacman-key --populate omarchy
-
-  # Sync the offline database so pacman can find packages
   pacman -Sy --noconfirm
 
   cleanup_install_disk "$(install_disk)"
 
-  # Workarounds for archinstall 4.2 regressions under Python 3.14:
-  # 1. sync_log_to_install_medium: `self.target / absolute_logfile` drops
-  #    self.target because the RHS is absolute, so Path.copy() raises EINVAL
-  #    (source == target).
-  # 2. _add_limine_bootloader: `Path.copy(efi_dir_path)` raises IsADirectoryError
-  #    because 3.14's Path.copy treats target as a literal path, not a directory
-  #    (shutil.copy used to auto-append the source filename).
+  # archinstall 4.2 / Python 3.14 workarounds (matches upstream-main install
+  # behavior; carry forward until upstream lands the fixes).
   sed -i \
     -e 's|logfile_target = self\.target / absolute_logfile$|logfile_target = self.target / absolute_logfile.relative_to("/")|' \
     -e 's|(limine_path / file)\.copy(efi_dir_path)|(limine_path / file).copy(efi_dir_path / file)|' \
     -e "s|(limine_path / 'limine-bios.sys')\.copy(boot_limine_path)|(limine_path / 'limine-bios.sys').copy(boot_limine_path / 'limine-bios.sys')|" \
     /usr/lib/python3.14/site-packages/archinstall/lib/installer.py
 
-  # Install using files generated by the ./configurator
-  # Skip NTP and WKD sync since we're offline (keyring is pre-populated in ISO)
   archinstall \
     --config user_configuration.json \
     --creds user_credentials.json \
@@ -159,19 +133,18 @@ install_base_system() {
     --skip-wkd \
     --skip-wifi-check
 
-  # After archinstall sets up the base system but before our installer runs,
-  # we need to ensure the offline pacman.conf is in place
+  # Use the offline pacman.conf for the target so it pulls from the bundled
+  # mirror, not from the network.
   cp /etc/pacman.conf /mnt/etc/pacman.conf
 
-  # Mount the offline mirror so it's accessible in the chroot
-  mkdir -p /mnt/var/cache/omarchy/mirror/offline
+  # Bind-mount the offline mirror + the /opt/packages tarballs into the target
+  # so chroot pacman / installer scripts can see them.
+  mkdir -p /mnt/var/cache/omarchy/mirror/offline /mnt/opt/packages
   mount --bind /var/cache/omarchy/mirror/offline /mnt/var/cache/omarchy/mirror/offline
-
-  # Mount the packages dir so it's accessible in the chroot
-  mkdir -p /mnt/opt/packages
   mount --bind /opt/packages /mnt/opt/packages
 
-  # No need to ask for sudo during the installation (omarchy itself responsible for removing after install)
+  # Temporary passwordless sudo for the install user (cleaned up by
+  # omarchy's first-run flow).
   mkdir -p /mnt/etc/sudoers.d
   cat >/mnt/etc/sudoers.d/99-omarchy-installer <<EOF
 root ALL=(ALL:ALL) NOPASSWD: ALL
@@ -179,17 +152,6 @@ root ALL=(ALL:ALL) NOPASSWD: ALL
 $OMARCHY_USER ALL=(ALL:ALL) NOPASSWD: ALL
 EOF
   chmod 440 /mnt/etc/sudoers.d/99-omarchy-installer
-
-  # Copy the local omarchy repo to the user's home directory
-  mkdir -p /mnt/home/$OMARCHY_USER/.local/share/
-  cp -r /root/omarchy /mnt/home/$OMARCHY_USER/.local/share/
-
-  chown -R 1000:1000 /mnt/home/$OMARCHY_USER/.local/
-
-  # Ensure all necessary scripts are executable
-  find /mnt/home/$OMARCHY_USER/.local/share/omarchy -type f -path "*/bin/*" -exec chmod +x {} \;
-  chmod +x /mnt/home/$OMARCHY_USER/.local/share/omarchy/boot.sh 2>/dev/null || true
-  find /mnt/home/$OMARCHY_USER/.local/share/omarchy/default/waybar -type f -name "*.sh" -exec chmod +x {} \; 2>/dev/null || true
 }
 
 configure_login_for_unencrypted_install() {
@@ -197,12 +159,6 @@ configure_login_for_unencrypted_install() {
     return
   fi
 
-  # Unencrypted installs must stop at SDDM so the user password is entered
-  # before reaching the desktop. Omarchy's normal encrypted path may autologin
-  # because the disk password was already entered at boot.
-  #
-  # Keep the Omarchy SDDM theme and seed SDDM's last user/session state so
-  # first boot looks like the SDDM screen shown after logging out of Omarchy.
   mkdir -p /mnt/etc/sddm.conf.d
   rm -f /mnt/etc/sddm.conf.d/autologin.conf
   cat >/mnt/etc/sddm.conf.d/99-omarchy-login.conf <<EOF
@@ -226,19 +182,21 @@ EOF
   arch-chroot /mnt systemctl enable sddm.service >/dev/null 2>&1 || true
 }
 
-chroot_bash() {
+# Run a bash command inside the chroot as the install user, with the env the
+# offline installer expects.
+chroot_run_as_user() {
   HOME=/home/$OMARCHY_USER \
-    arch-chroot -u $OMARCHY_USER /mnt/ \
-    env OMARCHY_CHROOT_INSTALL=1 \
+    arch-chroot -u "$OMARCHY_USER" /mnt/ \
+    env OMARCHY_INSTALL_MODE=offline \
     OMARCHY_USER_NAME="$(<user_full_name.txt)" \
     OMARCHY_USER_EMAIL="$(<user_email_address.txt)" \
     OMARCHY_MIRROR="$OMARCHY_MIRROR" \
     USER="$OMARCHY_USER" \
     HOME="/home/$OMARCHY_USER" \
-    /bin/bash "$@"
+    /bin/bash -lc "$1"
 }
 
-if [[ $(tty) == "/dev/tty1" ]]; then
+if [[ $(tty) == /dev/tty1 ]]; then
   use_omarchy_helpers
   run_configurator
   install_arch