feat(iso): split the live medium into semantic SquashFS layers

Booting via BMC virtual CD reads the ~2.8 GB filesystem squashfs
sequentially during the live-boot toram copy; a mid-read drop of the
redirected medium loses the whole copy and fails the boot (v14). Split
the rootfs into self-contained semantic layers so a retry re-reads at
most one ~500-700 MiB layer, not everything. This is a resilience /
reduced-re-read mechanism, not a fix for the virtual-media instability.

NVIDIA variants now ship 7 layers (00-base, 05-firmware, 08-desktop,
10-nvidia-driver, 20-nvidia-platform, 30-nvidia-cuda-libs,
40-nvidia-dcgm-cuda) plus an explicit live/filesystem.module that fixes
their OverlayFS order; amd/nogpu keep a single squashfs.

- lib/squashfs-layers.sh: deterministic classifier (dpkg file ownership
  plus explicit rules for build.sh-injected files, never a path
  substring), per-layer mksquashfs, 800 MiB hard ceiling, unsquashfs -s
  plus strict extraction of every layer, merged-rootfs bootability check.
- build.sh: split the monolith after the full lb build, verify and merge,
  write the module file, delete the monolith only then; abort before ISO
  assembly on any failure. Runs the builder test suites up front.
- fast-path: force a full build for a multi-layer medium;
  fast_path_repack_squashfs hard-refuses (it would drop layers).
- iso-validation.sh: validate_iso_squashfs_layers (module vs layer set
  match, size ceiling, no lone giant squashfs) and
  validate_iso_media_integrity (xorriso -check_media).
- bee-install: honour filesystem.module order, abort on any layer failure.
- 9013-toram-retry: record the real rsync exit code (it printed a false
  rc=0) and correct the "resumes the tail" comment (rsync without
  --partial keeps only fully-copied layers). No unsafe partial resume.
- tests: test-squashfs-layers.sh plus a multi-layer guard in
  test-build-libs.sh; both run at the top of every build.
- docs: bible-local architecture and decision, iso/README, iso-build-rules.

Verified by a full nvidia build: 7 layers 622/199/256/466/37/567/562 MiB,
every validator passes, xorriso -check_media good, merged rootfs bootable.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

iso/builder/lib/fast-path.sh

@@ -101,6 +101,15 @@ needs_full_build() {
         -name 'filesystem*.squashfs' 2>/dev/null | head -1)
     [ -n "$_any_sq" ]                                                    || return 0
 
+    # Multi-layer live medium: the fast path only knows how to repack a single
+    # squashfs and would drop every other layer. Force a full build until a
+    # layer-aware repack exists. Detected by the module file or >1 squashfs.
+    if [ -f "${BUILD_WORK_DIR}/binary/live/filesystem.module" ] || \
+       [ "$(find "${BUILD_WORK_DIR}/binary/live" -maxdepth 1 -name 'filesystem*.squashfs' 2>/dev/null | wc -l)" -gt 1 ]; then
+        echo "=== full build required: previous build produced a multi-layer squashfs medium ==="
+        return 0
+    fi
+
     _old_abi="$(cat "${FULL_BUILD_ABI_FILE}" 2>/dev/null)"
     if [ "${DEBIAN_KERNEL_ABI}" != "$_old_abi" ]; then
         echo "=== full build required: kernel ABI changed (${_old_abi:-unknown} -> ${DEBIAN_KERNEL_ABI}) ==="
@@ -126,6 +135,14 @@ needs_full_build() {
 # Fast path: unsquash existing filesystem, rsync overlay on top, repack.
 # CACHE_ROOT must have enough free space for the extracted root filesystem.
 fast_path_repack_squashfs() (
+    # Hard stop: this path takes the first squashfs and deletes the rest. On a
+    # multi-layer medium that silently loses every layer but base. needs_full_build
+    # already forces a full build here; this guard makes the invariant explicit.
+    if [ -f "${BUILD_WORK_DIR}/binary/live/filesystem.module" ] || \
+       [ "$(find "${BUILD_WORK_DIR}/binary/live" -maxdepth 1 -name 'filesystem*.squashfs' 2>/dev/null | wc -l)" -gt 1 ]; then
+        echo "ERROR: fast_path_repack_squashfs refuses to run on a multi-layer squashfs medium" >&2
+        exit 1
+    fi
     _old_sq=$(find "${BUILD_WORK_DIR}/binary/live" -maxdepth 1 \
         -name 'filesystem*.squashfs' | sort | head -1)
     _sq="${BUILD_WORK_DIR}/binary/live/${SQUASHFS_FILENAME}"