Fix ARM64 ISO: local kernel repo + Image symlink fallback

Dockerfile.arm64: after pre-downloading linux-aarch64, build a local
pacman repo from the cached package using repo-add so mkarchiso can
install the kernel from file:// without touching the [alarm] mirror.

entrypoint-arm64.sh: put [alarm-local] first in the profile pacman.conf
so pacstrap always resolves linux-aarch64 from the baked-in repo.
Also add a symlink fallback in customize_airootfs.sh: ALARM aarch64
may install the kernel as /boot/Image instead of /boot/vmlinuz-linux-aarch64;
the symlink ensures archiso's vmlinuz-* glob and systemd-boot both find it.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

iso/docker/Dockerfile.arm64

@@ -65,9 +65,13 @@ RUN git clone --depth=1 https://gitlab.archlinux.org/archlinux/archiso.git /tmp/
     cp -a /tmp/archiso/configs /usr/share/archiso/ && \
     rm -rf /tmp/archiso
 
-# Pre-download linux-aarch64 so mkarchiso can install it from local cache
-# even if the [alarm] mirror is unreliable at ISO-build time.
-RUN pacman -Sw --noconfirm linux-aarch64
+# Pre-download linux-aarch64 and create a local pacman repo so mkarchiso
+# can install the kernel without depending on the [alarm] mirror at build time.
+RUN pacman -Sw --noconfirm linux-aarch64 && \
+    mkdir -p /alarm-local-repo && \
+    find /var/cache/pacman/pkg -name "linux-aarch64-*.pkg.tar.*" ! -name "*.sig" \
+        -exec cp {} /alarm-local-repo/ \; && \
+    repo-add /alarm-local-repo/alarm-local.db.tar.gz /alarm-local-repo/linux-aarch64-*.pkg.tar.*
 
 WORKDIR /orionos
 COPY . .