scripts v1.18.0 — R-21 slice B: firmware loader option --loader shim|mkimage (F1)

Closes N100 F1 (HIGH): cheap AMI (AN3PLUS 0.01-class) UEFI firmware can't
relocate the ISO's stock signed GRUB from USB (relocation 0x0). The run's live
grub-mkimage workaround is now a first-class pipeline mode.

- build-felhom-iso.sh: --loader shim|mkimage (default shim, byte-for-byte
  unchanged; profile-settable FELHOM_LOADER; --loader wins). Loud banner +
  manifest loader:/grub-mkimage: fields + -mkimage filename suffix.
- mkimage-surgery.sh (new): post-prepare-iso, in the assistant container. Builds
  a monolithic grub-mkimage loader from the ISO's own GRUB (module set from its
  grub.cfg; embedded search --fs-uuid -> configfile the real menu). Swaps it into
  the ISO9660 tree (real lowercase path) + the efi.img ESP; xorriso re-master
  preserves BIOS-hybrid + UEFI + GPT-ESP, drops only Apple HFS+/APM. Recipe from
  the N100 run evidence, not re-derived.
- Dockerfile.assistant: grub-common + grub-efi-amd64-bin + mtools + dosfstools.
  profiles/n100.profile (new, mkimage + SB-off note).
- Validated on nested VM 311 (RUNBOOK-B legs): leg1 shim boots+installs under
  OVMF SB-enforcing + SeaBIOS; leg2 mkimage boots+installs under SB-off; leg3
  (red-proof) mkimage under SB-enforcing FAILS Access Denied (unsigned -> SB must
  be OFF); leg4 surgery byte-identical payload. bash -n + shellcheck clean.
  Physical N100 closure folds into the rehearsal (n100-safety match-nothing ISO
  built + sha-recorded, unbooted). PXE stays a deferred R-21 note.

scripts/iso/Dockerfile.assistant

@@ -9,8 +9,13 @@
 # Build:  docker build -f scripts/iso/Dockerfile.assistant -t felhom-iso-assistant:trixie scripts/iso
 FROM debian:trixie
 
+# xorriso: ISO (re-)mastering. shellcheck: lint. grub-mkimage (+ x86_64-efi module dir) and mtools:
+# the slice-B mkimage loader surgery — build a monolithic UEFI loader from the ISO's own GRUB modules
+# and inject it into the efi.img ESP (FAT, via mtools). grub 2.12 on trixie == the PVE 9.x ISO's
+# 2.12-9+pmx2 generation, so the tool matches the modules it embeds.
 RUN apt-get update && apt-get install -y --no-install-recommends \
         ca-certificates wget gnupg xorriso shellcheck \
+        grub-common grub-efi-amd64-bin mtools dosfstools \
     && rm -rf /var/lib/apt/lists/*
 
 # PVE 9.x (trixie) no-subscription repo — pairs the assistant to the 9.2 ISO generation.