feat(build): save build logs to out/ alongside the ISO

Before this commit, mkarchiso's verbose output streamed to the terminal and disappeared. The cleanup trap removed work/ after each build, taking any captured output with it. Failed builds left no log to compare against past failures — including the recurring archzfs cache corruption that hits ~2 of 3 builds.

I added a tee on the mkarchiso pipeline that writes to a log file in out/. The log starts as out/build-YYYY-MM-DD-HHMM.log, pre-created and chowned to SUDO_USER. It stays user-readable even when a failed build leaves it under that name. On success, the script renames it to match the ISO's basename so finding the log for a given ISO is a one-step lookup.

set -o pipefail was already on at the top of build.sh, so mkarchiso failures still propagate through the pipe and abort the script the way they used to. No exit-code masking.

I verified the change end-to-end against a real build that hit archzfs cache corruption (log captured, kept as build-2026-05-19-0325.log, user-readable) followed by a clean retry (log renamed to archangel-2026-05-19-vmlinuz-6.18.29-lts-x86_64.log, paired with the ISO).

2 files changed, 24 insertions, 2 deletions

diff --git a/README.org b/README.org
index edb1721..3ea1ff2 100644
--- a/README.org
+++ b/README.org
@@ -75,7 +75,9 @@ The build script will:
 
 - ISO location: ~out/archangel-YYYY-MM-DD-vmlinuz-{version}-lts-x86_64.iso~
 - Example: ~archangel-2026-01-18-vmlinuz-6.12.65-lts-x86_64.iso~
-- Build logs: visible in terminal output (not saved to disk)
+- Build log: ~out/<iso-basename>.log~ on success (matches the ISO name), or
+  ~out/build-YYYY-MM-DD-HHMM.log~ if the build failed before producing an ISO.
+  Logs survive the ~work/~ cleanup and are tee'd from ~mkarchiso~ in real time.
 
 ** Writing to USB
 
diff --git a/build.sh b/build.sh
index cc6686a..c64fb09 100755
--- a/build.sh
+++ b/build.sh
@@ -463,7 +463,18 @@ chmod +x "$PROFILE_DIR/airootfs/usr/local/bin/"*
 
 # Build the ISO
 info "Building ISO (this will take a while)..."
-mkarchiso -v -w "$WORK_DIR" -o "$OUT_DIR" "$PROFILE_DIR"
+
+# Pre-create the build log in out/ so it survives work/ cleanup. Owned
+# by SUDO_USER from the start so a failed build leaves a user-readable
+# log; tee writes to it as root, but the file mode stays as set.
+BUILD_LOG="$OUT_DIR/build-$(date +%Y-%m-%d-%H%M).log"
+mkdir -p "$OUT_DIR"
+touch "$BUILD_LOG"
+if [[ -n "${SUDO_USER:-}" ]]; then
+    chown "$SUDO_USER:$SUDO_USER" "$BUILD_LOG"
+fi
+
+mkarchiso -v -w "$WORK_DIR" -o "$OUT_DIR" "$PROFILE_DIR" 2>&1 | tee "$BUILD_LOG"
 
 # Restore ownership to the user who invoked sudo
 # mkarchiso runs as root and creates root-owned files
@@ -475,10 +486,19 @@ fi
 # Report results
 ISO_FILE=$(ls -t "$OUT_DIR"/*.iso 2>/dev/null | head -1)
 if [[ -f "$ISO_FILE" ]]; then
+    # Rename the build log to match the ISO so they pair on disk. A
+    # failed build keeps the build-YYYY-MM-DD-HHMM.log name and stays
+    # in out/ for inspection.
+    ISO_BASENAME=$(basename "$ISO_FILE" .iso)
+    RENAMED_LOG="$OUT_DIR/${ISO_BASENAME}.log"
+    mv "$BUILD_LOG" "$RENAMED_LOG"
+    BUILD_LOG="$RENAMED_LOG"
+
     echo ""
     info "Build complete!"
     info "ISO location: $ISO_FILE"
     info "ISO size: $(du -h "$ISO_FILE" | cut -f1)"
+    info "Build log: $BUILD_LOG"
     echo ""
     info "To test: ./scripts/test-vm.sh"
     echo ""