Fix ARM64 Dockerfile: bsdtar extraction + explicit SHELL for merged-usr

- Use libarchive-tools (bsdtar) instead of BusyBox tar to extract the
  ALARM tarball; bsdtar correctly preserves the /bin → usr/bin symlink
  that is part of ALARM's merged-usr filesystem layout
- Verify /usr/bin/bash exists after extraction so download failures are
  caught loudly instead of producing a silent empty rootfs
- Add SHELL ["/usr/bin/bash", "-c"] in stage 2: Docker's default RUN
  invocation looks up /bin/sh, which requires the symlink to be resolved
  in the container init — using the absolute path bypasses that entirely

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

iso/docker/Dockerfile.arm64

@@ -1,21 +1,32 @@
 # OrionOS ARM64 ISO builder
-# Stage 1: alpine downloads the official Arch Linux ARM rootfs (~300MB, Docker-cached).
-# Stage 2: builds OrionOS natively inside that ALARM environment.
-# Runs natively on Apple Silicon — no QEMU emulation needed.
+# Stage 1 (alpine): downloads the official Arch Linux ARM rootfs via bsdtar.
+# Stage 2 (scratch): installs packages and compiles OrionOS natively in ALARM.
 
-# ── Stage 1: fetch ALARM rootfs ───────────────────────────────────────
+# ── Stage 1: fetch and verify ALARM rootfs ────────────────────────────
 FROM --platform=linux/arm64 alpine:3.20 AS alarm-fetch
-RUN apk add --no-cache curl
-RUN mkdir /alarm-root && \
-    curl -fL https://os.archlinuxarm.org/os/ArchLinuxARM-aarch64-latest.tar.gz | \
-    tar xzf - -C /alarm-root 2>/dev/null || true
+# libarchive-tools provides bsdtar, which preserves ALARM's merged-usr symlinks
+# (BusyBox tar mishandles /bin → usr/bin symlinks in ALARM)
+RUN apk add --no-cache curl libarchive-tools
+
+RUN curl -fL --retry 3 --progress-bar \
+        https://os.archlinuxarm.org/os/ArchLinuxARM-aarch64-latest.tar.gz \
+        -o /tmp/alarm.tar.gz && \
+    mkdir /alarm-root && \
+    bsdtar -xpf /tmp/alarm.tar.gz -C /alarm-root && \
+    rm /tmp/alarm.tar.gz && \
+    # Verify extraction produced a usable ALARM environment
+    test -f /alarm-root/usr/bin/bash || \
+        (echo "ERROR: ALARM extraction failed — /usr/bin/bash missing" && exit 1)
 
 # ── Stage 2: Arch Linux ARM build environment ─────────────────────────
 FROM --platform=linux/arm64 scratch
 COPY --from=alarm-fetch /alarm-root/ /
 
-# Add DisableSandbox inside [options] (appending to file-end can land it
-# in a later section like [aur] where it is silently ignored)
+# ALARM uses merged-usr (/bin → usr/bin symlink). Docker's default /bin/sh
+# lookup fails when the symlink isn't resolved yet — use the absolute path.
+SHELL ["/usr/bin/bash", "-c"]
+
+# Add DisableSandbox inside [options] (not at file end where it lands in [aur])
 RUN sed -i '/^\[options\]/a DisableSandbox' /etc/pacman.conf
 
 RUN pacman-key --init && pacman-key --populate archlinuxarm