Add ARM64 ISO build for Apple Silicon / UTM

- iso/docker/Dockerfile.arm64: Arch Linux ARM base (menci/archlinuxarm:aarch64)
- iso/docker/entrypoint-arm64.sh: ARM64 archiso profile — linux-aarch64
  kernel, EFI-only boot (no syslinux), aarch64 squashfs path, spice-vdagent
  for UTM clipboard, VirtIO GPU modesetting config
- build-iso-arm64.sh: docker buildx --platform linux/arm64 wrapper;
  runs natively on Apple Silicon, no QEMU emulation needed

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

iso/docker/Dockerfile.arm64

@@ -0,0 +1,38 @@
+# OrionOS ARM64 ISO builder
+# Uses Arch Linux ARM as the base — runs natively on Apple Silicon.
+#
+# Build:  ./build-iso-arm64.sh   (wrapper handles docker buildx)
+# Output: dist/orionos-arm64-<date>.iso
+
+FROM menci/archlinuxarm:aarch64
+
+# disable pacman seccomp sandbox (breaks under QEMU / nested containers)
+RUN echo "DisableSandbox" >> /etc/pacman.conf
+
+# initialize pacman keys for ALARM
+RUN pacman-key --init && pacman-key --populate archlinuxarm
+
+# install build tools
+RUN pacman -Syu --noconfirm && \
+    pacman -S --noconfirm \
+        archiso \
+        base-devel \
+        libx11 \
+        libxft \
+        fontconfig \
+        freetype2 \
+        imlib2 \
+        imagemagick \
+        fakeroot \
+        git \
+        sudo \
+    && pacman -Scc --noconfirm
+
+WORKDIR /orionos
+COPY . .
+
+RUN make
+
+RUN bash themes/wallpapers/generate-default.sh || true
+
+ENTRYPOINT ["/orionos/iso/docker/entrypoint-arm64.sh"]