Fix ISO build pipeline for Docker on macOS

- Disable pacman alpm sandbox in Dockerfile (seccomp blocks it in BuildKit)
- Move mkarchiso from RUN to CMD so it runs with --privileged at docker run time
- Fix output path: mkarchiso now writes to /dist (matches volume mount)
- Add syslinux + imlib2 to Docker build packages and live ISO package list
- Copy syslinux/ and efiboot/ boot configs from archiso releng into profile
- Switch deprecated UEFI grub bootmodes to uefi-x64.systemd-boot
- Fix wrong package names: libpam→pam, light→brightnessctl, remove pkexec
- Set SigLevel=Never and hardcode reliable mirrors in profile pacman.conf
- Add mkinitcpio.conf with archiso hook so initrd can mount the live squashfs

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

iso/docker/Dockerfile

@@ -1,9 +1,13 @@
 FROM archlinux:latest
 
+# Disable pacman's alpm sandbox (seccomp-incompatible inside Docker/BuildKit)
+RUN echo "DisableSandbox" >> /etc/pacman.conf
+
 # Update and install archiso + OrionOS build dependencies
 RUN pacman -Syu --noconfirm && \
     pacman -S --noconfirm \
         archiso \
+        syslinux \
         base-devel \
         git \
         libx11 \
@@ -11,6 +15,7 @@ RUN pacman -Syu --noconfirm && \
         libxfixes \
         libxext \
         libpng \
+        imlib2 \
         dbus \
         pam \
         fontconfig \
@@ -30,8 +35,22 @@ WORKDIR /build
 # Copy OrionOS source
 COPY . /build/orionos
 
-# Build OrionOS components
-RUN cd /build/orionos && make 2>&1 | tail -20
+# Bootstrap boot loader configs from the installed archiso releng profile.
+# syslinux/ is required for bios.syslinux.mbr; efiboot/ for systemd-boot UEFI.
+# Fall back to a minimal loader.conf if releng ships without efiboot/.
+RUN cp -r /usr/share/archiso/configs/releng/syslinux \
+          /build/orionos/iso/profile/ && \
+    if [ -d /usr/share/archiso/configs/releng/efiboot ]; then \
+        cp -r /usr/share/archiso/configs/releng/efiboot \
+              /build/orionos/iso/profile/; \
+    else \
+        mkdir -p /build/orionos/iso/profile/efiboot/loader/entries && \
+        printf 'timeout 4\ndefault arch-*\n' \
+            > /build/orionos/iso/profile/efiboot/loader/loader.conf; \
+    fi
+
+# Build OrionOS components (full output — no tail so errors are visible)
+RUN cd /build/orionos && make
 
 # Install binaries into the staging root that archiso will include
 RUN cd /build/orionos && \
@@ -44,6 +63,7 @@ RUN cd /build/orionos && \
     install -Dm755 orionshot/orionshot     /build/orionos/iso/profile/airootfs/usr/local/bin/orionshot && \
     install -Dm755 orionclip/orionclip     /build/orionos/iso/profile/airootfs/usr/local/bin/orionclip && \
     install -Dm755 orionpkg/orionpkg       /build/orionos/iso/profile/airootfs/usr/local/bin/orionpkg && \
+    mkdir -p /build/orionos/iso/profile/airootfs/usr/share/themes/ && \
     cp -r themes/OrionOS /build/orionos/iso/profile/airootfs/usr/share/themes/ && \
     install -Dm644 themes/picom.conf       /build/orionos/iso/profile/airootfs/etc/orionos/picom.conf
 
@@ -53,10 +73,9 @@ RUN mkdir -p /build/orionos/iso/profile/airootfs/usr/share/orionos/wallpapers &&
     cp -f /build/orionos/themes/wallpapers/orionos-default.png \
           /build/orionos/iso/profile/airootfs/usr/share/orionos/wallpapers/ 2>/dev/null || true
 
-# Build the ISO
-RUN mkarchiso -v \
+# Build the ISO at container runtime — mkarchiso needs --privileged (from docker run)
+# Output goes to /dist which build-iso.sh mounts from the host.
+CMD mkarchiso -v \
     -w /tmp/iso-work \
-    -o /output \
+    -o /dist \
     /build/orionos/iso/profile
-
-CMD ["/bin/bash"]