fix(build): say so when the ISO ships without archsetupHEADmain

The 2026-08-02 build ran without ARCHSETUP_DIR set and produced a bare ISO with no complaint. A recovery image missing its setup tooling only reveals that on the machine you're recovering, which is the worst place to find out.

The build now warns when ARCHSETUP_DIR is unset or points at a non-directory, and the closing summary reports baked or not baked either way. Both go to the build log, since mkarchiso's output buries anything printed mid-run.

The remediation hint uses sudo's VAR=value form because build.sh needs root and env_reset drops an exported variable. It uses $HOME rather than a tilde, which zsh leaves unexpanded in an assignment.

1 files changed, 25 insertions, 0 deletions

diff --git a/build.sh b/build.sh
index ee70a55..13b49d1 100755
--- a/build.sh
+++ b/build.sh
@@ -548,6 +548,26 @@ if [[ -d "$ARCHSETUP_DIR" ]]; then
              --exclude='*.qcow2' \
              --exclude='*.iso' \
              "$ARCHSETUP_DIR" "$PROFILE_DIR/airootfs/code/"
+    ARCHSETUP_BAKED=yes
+else
+    # A recovery ISO without archsetup only reveals itself on the machine
+    # you're recovering, so say it at build time AND in the closing
+    # summary — mkarchiso's output buries anything printed here, and the
+    # operator walks away during the build. The 2026-08-02 build shipped
+    # bare this way and nobody knew until the reinstall.
+    #
+    # The hint uses sudo's VAR=value form on purpose: build.sh requires
+    # root, and sudo's env_reset drops an exported ARCHSETUP_DIR. It uses
+    # $HOME rather than ~ because zsh leaves the tilde unexpanded in an
+    # assignment-shaped argument, which would set the literal string and
+    # ship a bare ISO from following this very hint.
+    ARCHSETUP_BAKED=no
+    if [[ -n "$ARCHSETUP_DIR" ]]; then
+        warn "ARCHSETUP_DIR is not a directory: '$ARCHSETUP_DIR' — ISO ships WITHOUT archsetup" | tee -a "$BUILD_LOG"
+    else
+        warn "ARCHSETUP_DIR unset — ISO ships WITHOUT archsetup" | tee -a "$BUILD_LOG"
+    fi
+    warn "  to bake it in: sudo ARCHSETUP_DIR=\"\$HOME/code/archsetup\" ./build.sh" | tee -a "$BUILD_LOG"
 fi
 
 # Pre-populate tealdeer (tldr) cache for offline use
@@ -627,6 +647,11 @@ if [[ -f "$ISO_FILE" ]]; then
     info "ISO location: $ISO_FILE"
     info "ISO size: $(du -h "$ISO_FILE" | cut -f1)"
     info "Build log: $BUILD_LOG"
+    if [[ "${ARCHSETUP_BAKED:-no}" == "yes" ]]; then
+        info "archsetup: baked in at /code/archsetup"
+    else
+        warn "archsetup: NOT baked in — this ISO cannot set up a machine offline"
+    fi
     echo ""
     info "To test: ./scripts/test-vm.sh"
     echo ""