fix(build): keep private files out of the ISO, ship machine profiles

rsync -a copies by disk presence, so untracked personal-tooling state in the archsetup checkout rode into a portable USB image. The archsetup copy now excludes it.

The gitignored machine profiles (installer/*.conf) now ship to /root/ on the live ISO, so an unattended bare-metal reinstall has its profile without a repo checkout. The copy lists what shipped and warns when no profile exists. It also warns when a profile carries a non-placeholder credential, since the ISO is an unencrypted portable image.

1 files changed, 23 insertions, 0 deletions

diff --git a/build.sh b/build.sh
index 566a2a7..ee70a55 100755
--- a/build.sh
+++ b/build.sh
@@ -477,6 +477,24 @@ cp "$INSTALLER_DIR/zfssnapshot" "$PROFILE_DIR/airootfs/usr/local/bin/"
 mkdir -p "$PROFILE_DIR/airootfs/root"
 cp "$INSTALLER_DIR/archangel.conf.example" "$PROFILE_DIR/airootfs/root/"
 
+# Copy machine profiles so unattended reinstalls have them at /root/ on the
+# live ISO — without this a profile only exists in the repo checkout, which
+# a bare-metal recovery doesn't have. The profiles are gitignored and may
+# carry credentials; the ISO is a portable unencrypted image, so warn when a
+# profile holds anything beyond a known placeholder.
+machine_profiles=("$INSTALLER_DIR"/*.conf)
+if [[ -e "${machine_profiles[0]}" ]]; then
+    cp "${machine_profiles[@]}" "$PROFILE_DIR/airootfs/root/"
+    info "Copied machine profiles: $(basename -a "${machine_profiles[@]}" | tr '\n' ' ')"
+    for conf in "${machine_profiles[@]}"; do
+        if grep -E '^[A-Z_]*(PASSPHRASE|PASSWORD)=' "$conf" | grep -vqE '=(changeme|welcome)?$'; then
+            warn "$(basename "$conf") carries a non-placeholder credential — it will ride the ISO unencrypted"
+        fi
+    done
+else
+    warn "No machine profiles (installer/*.conf) found — ISO carries only archangel.conf.example"
+fi
+
 # Copy rescue guide
 info "Copying rescue guide..."
 cp "$INSTALLER_DIR/RESCUE-GUIDE.txt" "$PROFILE_DIR/airootfs/root/"
@@ -518,8 +536,13 @@ ARCHSETUP_DIR="${ARCHSETUP_DIR:-}"
 if [[ -d "$ARCHSETUP_DIR" ]]; then
     info "Copying archsetup into ISO..."
     mkdir -p "$PROFILE_DIR/airootfs/code"
+    # .ai and inbox are untracked personal-tooling state (session logs,
+    # private design docs, cross-project handoffs) — they must not ride a
+    # portable ISO image.
     rsync -a --exclude='.git' \
              --exclude='.claude' \
+             --exclude='.ai' \
+             --exclude='inbox' \
              --exclude='vm-images' \
              --exclude='test-results' \
              --exclude='*.qcow2' \