Fix ARM64 Dockerfile: two-stage build from official ALARM tarball

Stage 1 (alpine/arm64) downloads the official Arch Linux ARM rootfs via
curl — Docker caches this layer so it only runs once. Stage 2 (scratch)
COPYs the extracted filesystem in, then builds OrionOS natively in that
ALARM environment.

Also fixes DisableSandbox placement (insert into [options] section via
sed, not appended to file end where it lands in [aur] and is ignored).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

iso/docker/Dockerfile.arm64

@@ -1,19 +1,25 @@
 # OrionOS ARM64 ISO builder
-# Uses Arch Linux ARM as the base — runs natively on Apple Silicon.
-#
-# Build:  ./build-iso-arm64.sh   (wrapper handles docker buildx)
-# Output: dist/orionos-arm64-<date>.iso
+# Stage 1: alpine downloads the official Arch Linux ARM rootfs (~300MB, Docker-cached).
+# Stage 2: builds OrionOS natively inside that ALARM environment.
+# Runs natively on Apple Silicon — no QEMU emulation needed.
 
-FROM lopsided/archlinux:latest
+# ── Stage 1: fetch ALARM rootfs ───────────────────────────────────────
+FROM --platform=linux/arm64 alpine:3.20 AS alarm-fetch
+RUN apk add --no-cache curl
+RUN mkdir /alarm-root && \
+    curl -fL https://os.archlinuxarm.org/os/ArchLinuxARM-aarch64-latest.tar.gz | \
+    tar xzf - -C /alarm-root 2>/dev/null || true
 
-# disable pacman seccomp sandbox (breaks under QEMU / nested containers)
-RUN echo "DisableSandbox" >> /etc/pacman.conf
+# ── Stage 2: Arch Linux ARM build environment ─────────────────────────
+FROM --platform=linux/arm64 scratch
+COPY --from=alarm-fetch /alarm-root/ /
 
-# initialize pacman keys for ALARM
-RUN pacman-key --init && pacman-key --populate archlinuxarm 2>/dev/null || \
-    pacman-key --populate archlinux
+# Add DisableSandbox inside [options] (appending to file-end can land it
+# in a later section like [aur] where it is silently ignored)
+RUN sed -i '/^\[options\]/a DisableSandbox' /etc/pacman.conf
+
+RUN pacman-key --init && pacman-key --populate archlinuxarm
 
-# install build tools
 RUN pacman -Syu --noconfirm && \
     pacman -S --noconfirm \
         archiso \