build-iso.sh bakes tzupdate into the live environment, so the runtime pacman fallback was dead there — and in a dry run on a dev machine it would install a package as a side effect. tzupdate -p already fails gracefully into the manual timezone filter when the tool is missing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>