iso: actually pass FELHOM_MENU/FELHOM_DEB to the repack

The repack read both correctly; the caller never set them, so a --release build reached the
narrowed R-155 guard still in 'single' mode and was refused (rc=10). Caught by the build's true
exit code. Also copies grub-release.cfg.tmpl into the brand dir and fixes the branding log line,
which claimed 'single-entry menu' unconditionally.

scripts/iso/build-felhom-iso.sh

@@ -433,9 +433,14 @@ if $BRAND || [[ "$LOADER" == "mkimage" ]]; then
         cp "$HERE/grub/grub.cfg.tmpl" "$HERE/grub/felhom-theme.txt" \
            "$HERE/grub/generate-grub-background.sh" "$WORK/brand/"
         cp "$BRAND_IMAGE" "$WORK/brand/card.png"
+        $RELEASE && cp "$HERE/grub/grub-release.cfg.tmpl" "$WORK/brand/"
     fi
+    REPACK_MENU=single; $RELEASE && REPACK_MENU=release
+    REPACK_DEB=""
+    if [[ -n "${RELEASE_DEB:-}" ]]; then cp "$RELEASE_DEB" "$WORK/felhom.deb"; REPACK_DEB=/work/felhom.deb; fi
     docker run --rm -v "$WORK":/work \
         -e FELHOM_LOADER="$LOADER" -e FELHOM_BRAND="$($BRAND && echo 1 || echo 0)" \
+        -e FELHOM_MENU="$REPACK_MENU" -e FELHOM_DEB="$REPACK_DEB" \
         "$IMAGE" bash /work/iso-repack.sh 2>&1 | sed 's/^/    [repack] /'
     [[ -f "$WORK/final.iso" ]] || die "repack produced no output (see [repack] log above)"
     GRUB_VERSION="$(cat "$WORK/grub-version.txt" 2>/dev/null || echo unknown)"

scripts/iso/iso-repack.sh

@@ -103,7 +103,7 @@ cp "$GCFG" "$ORIG_CFG"
 # --- 2. BRANDING + SINGLE-ENTRY MENU SURGERY (R-38) ------------------------------------------------
 #====================================================================================================
 if [[ "$BRAND" == "1" ]]; then
-    say "branding GRUB (background + single-entry menu)"
+    say "branding GRUB (background + $( [[ "$MENU" == "release" ]] && echo "two-entry INTERACTIVE release menu" || echo "single-entry menu" ))"
 
     # 2a. R-155 — the guard, NARROWED rather than removed.
     #