Fix ARM64 Dockerfile: two-stage build from official ALARM tarball

Stage 1 (alpine/arm64) downloads the official Arch Linux ARM rootfs via
curl — Docker caches this layer so it only runs once. Stage 2 (scratch)
COPYs the extracted filesystem in, then builds OrionOS natively in that
ALARM environment.

Also fixes DisableSandbox placement (insert into [options] section via
sed, not appended to file end where it lands in [aur] and is ignored).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

build-iso-arm64.sh

@@ -1,9 +1,6 @@
 #!/usr/bin/env bash
 # OrionOS ARM64 ISO builder — for Apple Silicon Macs (runs natively, no emulation).
-# On Intel Macs, this uses QEMU arm64 emulation (much slower).
-#
-# Requirements: Docker Desktop with "Use Rosetta for x86_64/amd64 emulation" OFF
-#               (Rosetta emulation is for x86, not needed here)
+# First run downloads Arch Linux ARM rootfs (~300MB); cached by Docker afterwards.
 #
 # Usage:  ./build-iso-arm64.sh
 # Output: dist/orionos-arm64-<date>.iso
@@ -16,25 +13,16 @@ ISO_TAG="orionos-arm64-$(date +%Y%m%d)"
 
 # ── preflight ─────────────────────────────────────────────────────────
 if ! command -v docker &>/dev/null; then
-    echo ""
     echo "  Docker is not installed."
     echo "  Install Docker Desktop: https://www.docker.com/products/docker-desktop/"
     exit 1
 fi
 
 if ! docker info &>/dev/null; then
-    echo ""
     echo "  Docker is not running. Open Docker Desktop and re-run."
     exit 1
 fi
 
-# Ensure buildx is available (ships with Docker Desktop)
-if ! docker buildx version &>/dev/null; then
-    echo ""
-    echo "  docker buildx not found. Update Docker Desktop to a recent version."
-    exit 1
-fi
-
 echo ""
 echo "┌─────────────────────────────────────────────┐"
 echo "│       OrionOS ARM64 ISO Builder              │"
@@ -43,8 +31,8 @@ echo "└───────────────────────
 echo ""
 
 # ── build the builder image ───────────────────────────────────────────
-echo "Step 1/3: Building Docker image (ARM64, Arch Linux ARM base)"
-echo "          First run downloads ~400MB — cached afterwards."
+echo "Step 1/3: Building Docker image"
+echo "          First run downloads ALARM rootfs (~300MB) — cached afterwards."
 echo ""
 docker buildx build \
     --platform linux/arm64 \
@@ -93,9 +81,9 @@ echo "│    1. Open UTM → New VM → Virtualize                │"
 echo "│    2. Choose Linux → enable Apple Virtualization     │"
 echo "│    3. Boot ISO: select the file above               │"
 echo "│    4. Display: VirtIO GPU (recommended)             │"
-echo "│    5. Boot — OrionOS will auto-login as 'orion'     │"
+echo "│    5. Boot — OrionOS auto-logs in as 'orion'        │"
 echo "│                                                      │"
 echo "│  Copy-paste between macOS and VM:                    │"
-echo "│    spice-vdagent is pre-installed and auto-started  │"
+echo "│    spice-vdagent runs automatically on login        │"
 echo "└─────────────────────────────────────────────────────┘"
 echo ""