iso: two build-log lines stated things that were not true

Neither changes an artifact, but both are read by an operator deciding whether a build is sound:

- the closing banner printed 'root-pw : <iso>.rootpw.txt ... the console credential for this build'
  unconditionally. In --release mode no password is minted and no such file is written (verified:
  the release build emits only .iso, .sha256 and .manifest.txt). It now says so.
- the repack's menu-surgery line hardcoded '1 entry, 0 submenus' and printed it after a gate that
  had just accepted TWO. It now reports the counts it actually asserted.

scripts/iso/build-felhom-iso.sh

@@ -492,7 +492,11 @@ log_success "ISO built: $OUT_ISO"
 log_info    "sha256   : $OUT_SHA"
 log_info    "size     : $OUT_SIZE bytes"
 log_info    "manifest : $OUT_ISO.manifest.txt"
-log_info    "root-pw  : $OUT_ISO.rootpw.txt (0600, operator-only — the console credential for this build; never commit/paste)"
+if $RELEASE; then
+    log_info "root-pw  : NONE — no password is baked and no .rootpw.txt is emitted (release gate G2)"
+else
+    log_info "root-pw  : $OUT_ISO.rootpw.txt (0600, operator-only — the console credential for this build; never commit/paste)"
+fi
 if $RELEASE; then
     log_success "PUBLIC RELEASE image — no answer file, no baked credential, interactive disk selection."
     log_info    "Run the release gate before publishing: documentation/runbooks/iso-release-gate.md"

scripts/iso/iso-repack.sh

@@ -241,7 +241,7 @@ initrd-line        : $(sed -E 's/^[[:space:]]+//' <<<"$INITRD_LINE")
 theme              : /boot/grub/felhomtheme/theme.txt (stock pvetheme removed)
 background         : 1024x768 PNG24 from website/assets/og-image_2.png
 EOF
-    say "menu surgery OK — 1 entry, 0 submenus, stock installers not emitted"
+    say "menu surgery OK — $N_ENTRY entr(y/ies), $N_SUB submenus, banned entries not emitted"
 fi
 
 #====================================================================================================