ISO train v1.25.0 code: OOB belt default appliance leg (F9) + apt no-subscription (Part2) + R-63 Lat2 console font + R-71 golden>=floor build gate

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NKSN3gSg4TKVBBqkwW2djR

scripts/iso/felhom-bootstrap.sh

@@ -64,6 +64,7 @@ log() { echo "felhom-bootstrap: $*"; }
 print_pairing_banner() {
     local code; code=$(cat "$PAIRING_CODE_FILE" 2>/dev/null)
     [[ -n "$code" ]] || return 0
+    set_console_font   # R-63: ő/ű-capable font before painting (once)
     { printf '\n================================================\n'
       printf '  Felhom — a doboz készen áll, és a párosításra vár.\n\n'
       printf '  Párosító kód:  %s\n\n' "$code"
@@ -109,6 +110,26 @@ SWEEP_DHCP_TIMEOUT=20    # F-P1/F-P4: a real lease lands in ~3s; a dead NIC neve
 HUB_PROBE_TIMEOUT=10
 GATE_ORIG_COPY=/run/felhom-interfaces.orig
 
+# R-63 (v1.25.0): the kernel's default console font lacks the Hungarian double-acute ő/ű glyphs, so
+# the R-59 network screen (élő / telepítő / ellenőrizze) and the pairing banner (képernyő / teendő)
+# rendered them as blanks. Load a Latin-2 console font ONCE before the first paint — idempotent and
+# strictly best-effort: a missing font or an ioctl failure (e.g. a serial console) must NEVER block
+# the boot. Lat2 fonts ship in the trixie/PVE base (console-setup), so no copy rewording is needed.
+FONT_SET=0
+set_console_font() {
+    [[ "$FONT_SET" == 1 ]] && return 0
+    FONT_SET=1
+    command -v setfont >/dev/null 2>&1 || return 0
+    local fnt
+    for fnt in Lat2-Terminus16 Lat2-Fixed16 Lat2-Terminus14; do
+        if setfont "$fnt" -C "$CONSOLE_DEV" >/dev/null 2>&1 || setfont "$fnt" >/dev/null 2>&1; then
+            log "console font -> $fnt (Latin-2, ő/ű capable)"
+            return 0
+        fi
+    done
+    log "console font: no Latin-2 font loaded (setfont unavailable/failed) — accented chars may show as boxes"
+}
+
 hub_reachable() {
     # F-P5: ANY HTTP status proves TLS+HTTP reachability (the hub answers / with a 302); only
     # 000/empty means no contact.
@@ -231,6 +252,7 @@ paint_network_screen() {
     # R-59: the legible refuse-loudly screen (print_pairing_banner pattern — /dev/console, stdout
     # fallback). Calm adult Hungarian; spec-fixed copy.
     local table="$1" fbnote="$2"
+    set_console_font   # R-63: ő/ű-capable font before painting (once)
     { printf '\n================================================\n'
       printf '  Felhom — Nincs hálózati kapcsolat: a doboz nem éri\n'
       printf '  el a felhom.eu szolgáltatást.\n\n'