feat(linux/build): scaffold reproducible ISO build pipeline (M1.1)

Vendors Kicksecure derivative-maker as a pinned submodule (18.1.7.4),
adds the wrapper + verify + diagnose scripts, the pinned builder image,
and the reproducibility-gated Gitea Actions workflow. Base flavour only —
no hardening overlay (that's M1.2).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

shared/branding/linux-iso-meta.yaml

@@ -0,0 +1,37 @@
+# SilverMetal Linux — ISO branding metadata
+#
+# Single source of truth for ISO label, /etc/os-release, GRUB title.
+# Referenced by linux/build/config/silvermetal-base.conf and any later overlay.
+# Do not duplicate these values elsewhere — read them from here.
+
+schema_version: 1
+
+# Phase-1 milestone 1.1 ships a *base* (un-hardened) Kicksecure derivative.
+# The hardened variant lands in M1.2 and SHOULD use a different `id` so that
+# os-release reflects what the user actually has installed.
+id: silvermetal-linux-base
+name: SilverMetal Linux (Base)
+short_name: SilverMetal
+pretty_name: SilverMetal Linux Base
+version_codename: bookworm
+home_url: https://silvermetal.silverlabs.uk
+support_url: https://silvermetal.silverlabs.uk/support
+bug_report_url: https://git.silverlabs.uk/SilverLABS/SilverMetal/issues
+privacy_policy_url: https://silvermetal.silverlabs.uk/privacy
+
+# Versioning: <phase>.<milestone>.<patch>[-tag]
+# M1.1 produces 1.1.0-alpha builds until two clean builds match SHA256.
+version: 1.1.0-alpha
+
+# ISO9660 volume id is capped at 32 chars, uppercase, no spaces.
+iso_label: SILVERMETAL_LINUX_BASE
+
+# Used by GRUB / isolinux menu rendering.
+grub_title: SilverMetal Linux (Base) — live
+grub_distributor: SilverMetal
+
+# os-release fields that aren't covered by the standardised keys above.
+os_release_extra:
+  ANSI_COLOR: "1;36"             # cyan, matches SilverLABS visual identity
+  LOGO: silvermetal
+  DOCUMENTATION_URL: https://silvermetal.silverlabs.uk/docs