iso: two build-log lines stated things that were not true

Neither changes an artifact, but both are read by an operator deciding whether a build is sound:

- the closing banner printed 'root-pw : <iso>.rootpw.txt ... the console credential for this build'
  unconditionally. In --release mode no password is minted and no such file is written (verified:
  the release build emits only .iso, .sha256 and .manifest.txt). It now says so.
- the repack's menu-surgery line hardcoded '1 entry, 0 submenus' and printed it after a gate that
  had just accepted TWO. It now reports the counts it actually asserted.

scripts/iso/iso-repack.sh

@@ -241,7 +241,7 @@ initrd-line        : $(sed -E 's/^[[:space:]]+//' <<<"$INITRD_LINE")
 theme              : /boot/grub/felhomtheme/theme.txt (stock pvetheme removed)
 background         : 1024x768 PNG24 from website/assets/og-image_2.png
 EOF
-    say "menu surgery OK — 1 entry, 0 submenus, stock installers not emitted"
+    say "menu surgery OK — $N_ENTRY entr(y/ies), $N_SUB submenus, banned entries not emitted"
 fi
 
 #====================================================================================================