migrate ISO build from Alpine to Debian 12 (Bookworm)

Replace the entire live CD build pipeline:
- Alpine SDK + mkimage + genapkovl → Debian live-build (lb config/build)
- OpenRC init scripts → systemd service units
- dropbear → openssh-server (native to Debian live)
- udhcpc → dhclient for DHCP
- apk → apt-get in setup-builder.sh and build-nvidia-module.sh
- Add auto/config (lb config options) and auto/build wrapper
- Add config/package-lists/bee.list.chroot replacing Alpine apks
- Add config/hooks/normal/9000-bee-setup.hook.chroot to enable services
- Add bee-nvidia-load and bee-sshsetup helper scripts
- Keep NVIDIA pre-compile pipeline (Option B): compile on builder VM against
  pinned Debian kernel headers (DEBIAN_KERNEL_ABI), inject .ko into includes.chroot
- Fixes: native glibc (no gcompat shims), proper udev, writable /lib/modules,
  no Alpine modloop read-only constraint, no stale apk cache issues

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

iso/overlay/usr/local/bin/bee-sshsetup

@@ -0,0 +1,18 @@
+#!/bin/sh
+# bee-sshsetup — configure SSH access
+# Called by bee-sshsetup.service before SSH starts.
+
+log() { echo "[bee-sshsetup] $*"; }
+
+# Always create dedicated 'bee' user for password fallback.
+if ! id bee > /dev/null 2>&1; then
+    useradd -m -s /bin/sh bee > /dev/null 2>&1
+fi
+echo "bee:eeb" | chpasswd > /dev/null 2>&1
+
+if [ -f /etc/bee-ssh-password-fallback ]; then
+    log "SSH key auth unavailable — password fallback active"
+    log "Login: bee / eeb"
+else
+    log "SSH key auth configured"
+fi