build(iso): unify GRUB/isolinux boot menus, add iommu=pt to fail-safe

The GRUB and isolinux menus (and their two sources of truth — the staged
templates and build.sh's write_canonical_* generators that rewrite the built
menu) had drifted: GRUB shipped a lean set, isolinux carried extra
display-debug entries (gsp-off, kms, kms-gsp-off) and lacked a WIPE entry in
the canonical writer. Collapse all four to one set:

  normal, load-to-RAM (default), no-GUI/troubleshooting (gsp-off, pci=realloc),
  fail-safe, WIPE ALL DISKS, Memory Test, + UEFI Firmware Settings (EFI only)

The fail-safe entry gains iommu=pt (AMD-Vi passthrough) — the OS-side half of
the vendor fix for the MSI CG480-S6053 cross-socket nvbandwidth reboot; ACS
can't be toggled from a stock-kernel cmdline so that stays a BIOS setting.
default stays index 1 = toram (config.cfg set default=1).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

iso/builder/config/bootloaders/grub-efi/grub.cfg

@@ -15,6 +15,10 @@ menuentry "EASY-BEE v@VERSION@ -- no GUI / troubleshooting (gsp-off, pci=realloc
     initrd  @INITRD_LIVE@
 }
 
+menuentry "EASY-BEE v@VERSION@ -- fail-safe (iommu=pt)" {
+    linux   @KERNEL_LIVE@ @APPEND_LIVE@ nomodeset bee.nvidia.mode=gsp-off noapic noapm nodma nomce nolapic nosmp vga=normal iommu=pt net.ifnames=0 biosdevname=0
+    initrd  @INITRD_LIVE@
+}
 
 menuentry "*** WIPE ALL DISKS (irreversible!) ***" {
     linux   @KERNEL_LIVE@ @APPEND_LIVE@ toram nomodeset bee.gui=off bee.wipe=all net.ifnames=0 biosdevname=0