fix(iso): auto-detect kernel ABI at build time instead of pinning

DEBIAN_KERNEL_ABI=auto in VERSIONS — build.sh queries
apt-cache depends linux-image-amd64 to find the current ABI.
lb config now uses linux-image-amd64 meta-package.

This prevents build failures when Debian drops old kernel packages
from the repo (happens with every point release).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

iso/builder/VERSIONS

@@ -1,5 +1,5 @@
 DEBIAN_VERSION=12
-DEBIAN_KERNEL_ABI=6.1.0-44
+DEBIAN_KERNEL_ABI=auto
 NVIDIA_DRIVER_VERSION=590.48.01
 NCCL_VERSION=2.28.9-1
 NCCL_CUDA_VERSION=13.0

iso/builder/auto/config

@@ -19,7 +19,7 @@ lb config noauto \
     --mirror-binary "https://deb.debian.org/debian" \
     --security true \
     --linux-flavours "amd64" \
-    --linux-packages "linux-image-${DEBIAN_KERNEL_ABI}" \
+    --linux-packages "linux-image-amd64" \
     --memtest none \
     --iso-volume "BEE" \
     --iso-application "Bee Hardware Audit" \

iso/builder/build.sh

@@ -34,6 +34,20 @@ mkdir -p "${CACHE_ROOT}"
 : "${GOMODCACHE:=${CACHE_ROOT}/go-mod}"
 export GOCACHE GOMODCACHE
 
+# Auto-detect kernel ABI from apt when not pinned explicitly.
+if [ -z "${DEBIAN_KERNEL_ABI}" ] || [ "${DEBIAN_KERNEL_ABI}" = "auto" ]; then
+    DEBIAN_KERNEL_ABI=$(apt-cache depends linux-image-amd64 2>/dev/null \
+        | awk '/Depends:.*linux-image-[0-9]/{print $2}' \
+        | grep -oE '[0-9]+\.[0-9]+\.[0-9]+-[0-9]+' \
+        | head -1)
+    if [ -z "${DEBIAN_KERNEL_ABI}" ]; then
+        echo "ERROR: could not auto-detect kernel ABI from apt-cache" >&2
+        echo "  Run: apt-cache depends linux-image-amd64" >&2
+        exit 1
+    fi
+    echo "=== kernel ABI auto-detected: ${DEBIAN_KERNEL_ABI} ==="
+fi
+
 echo "=== bee ISO build ==="
 echo "Debian: ${DEBIAN_VERSION}, Kernel ABI: ${DEBIAN_KERNEL_ABI}, Go: ${GO_VERSION}"
 echo ""