fix(iso): pin ISO kernel to same ABI as compiled NVIDIA modules

Export detected DEBIAN_KERNEL_ABI as BEE_KERNEL_ABI from build.sh so
auto/config can pin linux-packages to the exact versioned package
(e.g. linux-image-6.1.0-31 + flavour amd64 = linux-image-6.1.0-31-amd64).
This prevents nvidia.ko vermagic mismatch if the linux-image-amd64
meta-package is updated between build start and lb build chroot step.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

iso/builder/auto/config

@@ -7,6 +7,15 @@ set -e
 
 . "$(dirname "$0")/../VERSIONS"
 
+# Pin the exact kernel ABI detected by build.sh so the ISO kernel matches
+# the kernel headers used to compile NVIDIA modules. Falls back to meta-package
+# when lb config is run manually without the environment variable.
+if [ -n "${BEE_KERNEL_ABI:-}" ] && [ "${BEE_KERNEL_ABI}" != "auto" ]; then
+    LB_LINUX_PACKAGES="linux-image-${BEE_KERNEL_ABI}"
+else
+    LB_LINUX_PACKAGES="linux-image"
+fi
+
 lb config noauto \
     --distribution bookworm \
     --architectures amd64 \
@@ -19,7 +28,7 @@ lb config noauto \
     --mirror-binary "https://deb.debian.org/debian" \
     --security true \
     --linux-flavours "amd64" \
-    --linux-packages "linux-image" \
+    --linux-packages "${LB_LINUX_PACKAGES}" \
     --memtest none \
     --iso-volume "EASY-BEE" \
     --iso-application "EASY-BEE" \

iso/builder/build.sh

@@ -51,6 +51,11 @@ if [ -z "${DEBIAN_KERNEL_ABI}" ] || [ "${DEBIAN_KERNEL_ABI}" = "auto" ]; then
     echo "=== kernel ABI: ${DEBIAN_KERNEL_ABI} ==="
 fi
 
+# Export detected ABI so that auto/config can pin the exact kernel package
+# (prevents NVIDIA module/kernel mismatch if linux-image-amd64 meta-package
+# gets updated between build.sh start and lb build chroot step)
+export BEE_KERNEL_ABI="${DEBIAN_KERNEL_ABI}"
+
 KVER="${DEBIAN_KERNEL_ABI}-amd64"
 if [ ! -d "/usr/src/linux-headers-${KVER}" ]; then
     echo "=== installing linux-headers-${KVER} (kernel updated since image build) ==="