Wire up installer, networking, and fix UEFI boot entry

- Dockerfile: compile and install orioninstall-gui + orioninstall script
- packages: add rsync, parted, arch-install-scripts, grub, efibootmgr,
  dosfstools, amd/intel-ucode, wpa_supplicant
- customize_airootfs.sh: enable NetworkManager + wpa_supplicant on boot
- orioninstall: fix UEFI (ESP at /boot, not /boot/efi); pass TIMEZONE
  and KEYBOARD into chroot heredoc; conditionalize microcode initrd lines
- menu: launch orioninstall-gui via pkexec (runs as root)
- profiledef: add file_permissions for installer binaries

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

installer/orioninstall

@@ -152,8 +152,8 @@ progress 14 "Mounting partitions…"
 info "Mounting..."
 mount "$ROOT_PART" /mnt
 if [[ "$BOOT_MODE" == "uefi" ]]; then
-    mkdir -p /mnt/boot/efi
-    mount "$EFI_PART" /mnt/boot/efi
+    mkdir -p /mnt/boot
+    mount "$EFI_PART" /mnt/boot
 fi
 ok "Mounted."
 
@@ -197,9 +197,11 @@ info "Configuring system..."
 
 arch-chroot /mnt /bin/bash -s "$HOSTNAME" "$USERNAME" "$PASSWORD" \
                                 "$BOOT_MODE" "$ROOT_PART" \
+                                "${TIMEZONE:-UTC}" "${KEYBOARD:-us}" \
     <<'CHROOT'
 HOSTNAME="$1"; USERNAME="$2"; PASSWORD="$3"
 BOOT_MODE="$4"; ROOT_PART="$5"
+TIMEZONE="${6:-UTC}"; KEYBOARD="${7:-us}"
 
 # Hostname
 echo "$HOSTNAME" > /etc/hostname
@@ -268,22 +270,20 @@ mkinitcpio -P
 
 # Bootloader
 if [[ "$BOOT_MODE" == "uefi" ]]; then
-    bootctl install 2>/dev/null || true
+    bootctl --esp-path=/boot install 2>/dev/null || true
     ROOT_UUID="$(blkid -s UUID -o value "$ROOT_PART")"
-    mkdir -p /boot/efi/loader/entries
-    cat > /boot/efi/loader/loader.conf <<'LC'
-default skyos.conf
+    mkdir -p /boot/loader/entries
+    cat > /boot/loader/loader.conf <<'LC'
+default orionos.conf
 timeout 5
 editor  no
 LC
-    cat > /boot/efi/loader/entries/skyos.conf <<ENTRY
-title   OrionOS
-linux   /vmlinuz-linux
-initrd  /amd-ucode.img
-initrd  /intel-ucode.img
-initrd  /initramfs-linux.img
-options root=UUID=${ROOT_UUID} rw quiet loglevel=3
-ENTRY
+    # Build initrd lines — only include microcode if the image exists
+    INITRD_LINES="initrd  /initramfs-linux.img"
+    [[ -f /boot/amd-ucode.img   ]] && INITRD_LINES="initrd  /amd-ucode.img\n${INITRD_LINES}"
+    [[ -f /boot/intel-ucode.img ]] && INITRD_LINES="initrd  /intel-ucode.img\n${INITRD_LINES}"
+    printf "title   OrionOS\nlinux   /vmlinuz-linux\n%b\noptions root=UUID=%s rw quiet loglevel=3\n" \
+        "$INITRD_LINES" "$ROOT_UUID" > /boot/loader/entries/orionos.conf
 else
     # Find the whole disk (strip trailing partition number)
     DISK="${ROOT_PART%[0-9]}"
@@ -305,7 +305,7 @@ ok "System configured."
 progress 97 "Unmounting…"
 info "Unmounting..."
 sync
-[[ "$BOOT_MODE" == "uefi" ]] && umount /mnt/boot/efi 2>/dev/null || true
+[[ "$BOOT_MODE" == "uefi" ]] && umount /mnt/boot 2>/dev/null || true
 umount /mnt
 ok "Done."