docs: overhaul to match current repo reality (DE/DM selectors, SDDM pixie theme, overlays, offline installer, CI)

- index/installer/launcher: release facts, SDDM theme (pixie on master), init/DE selectors, NoExtract for Install Artix entry
- packages: branding pkg ships offline+online settings (no packagechooser.conf fallback), drop antergos-sddm-theme, correct repo index names
- overlays/overlay-root/overlay-live: root-overlay is live-session only, real file trees, symlinked settings.conf, commit reference
- desktop-environments/wallpapers: remove No Desktop option, video wallpaper via layan-theme + Smart Video Wallpaper Reborn
- ci/development/building: three workflows incl. ai-moderator, IA upload disabled (if:false)
- byode: new page documenting the SteamOS-inspired offline installer
- AGENTS.md/openrc: OpenRC was an installer-only dinit conflict; manual rc-update add works

docs/ci.md

@@ -6,11 +6,11 @@ nav_order: 7
 
 # CI/CD Pipeline
 
-Two GitHub Actions workflows:
+Three GitHub Actions workflows:
 
 ## Build ISO (`build.yml`)
 
-Triggers on **manual `workflow_dispatch`** only (push to master does NOT trigger a build). Runs in an `artixlinux/artixlinux:base` container.
+Triggers on **manual `workflow_dispatch`** only (push to master does NOT trigger a build). Runs in an `artixlinux/artixlinux:base` container with `--privileged`.
 
 ### Steps
 
@@ -19,24 +19,29 @@ Triggers on **manual `workflow_dispatch`** only (push to master does NOT trigger
 3. Override pacman config with `[antergos-pkgs]` repo (`pacman.conf.d/iso-x86_64.conf`)
 4. Mount a 12 GB tmpfs at `/var/lib/artools/buildiso`
 5. Run `./buildiso -p antergos`
-6. Upload the ISO and checksum as build artifacts
+6. Upload the ISO as a build artifact
 
 ### Internet Archive upload
 
-Uploads the built ISO to the Internet Archive with:
+The workflow includes an Internet Archive upload step, but it is **currently disabled** (`if: false`) — the maintainer is the only QA team and builds are manually verified first. When re-enabled it uploads with:
 
 - **Collection**: `open_source_software` (Community Software, _not_ Community Texts)
 - **Identifier**: `antergos-next-YYYYMMDD-<run_number>` (e.g. `antergos-next-20260711-162`)
 - **Credentials**: `IA_ACCESS_KEY` and `IA_SECRET_KEY` (repo secrets)
 
-The `-<run_number>` suffix guarantees unique identifiers across CI runs. If two pushes produce the same date, they still get different archive entries.
+The `-<run_number>` suffix guarantees unique identifiers across CI runs.
 
 ### Secrets
 
 | Secret | Purpose |
 |--------|---------|
-| `IA_ACCESS_KEY` | Internet Archive S3 access key |
+| `IA_ACCESS_KEY` | Internet Archive S3 access key (for the disabled IA step) |
 | `IA_SECRET_KEY` | Internet Archive S3 secret key |
+| `GROQ_API_KEY` | Groq API key for the AI moderator |
+
+## AI community moderator (`ai-moderator.yml`)
+
+Triggers on issue open, issue/PR comment, discussion, and discussion comment. Uses the Groq API (`llama-3.1-8b-instant`) via `actions/github-script@v9` to check posts against the Code of Conduct and `CONTRIBUTING.md`. May warn, hide comments, or lock threads. See `ai-moderator.yml` for details.
 
 ## Deploy docs (`pages.yml`)
 
@@ -49,5 +54,5 @@ Separate workflow in the [antergos-packages](https://github.com/Antergos-NeXT/an
 ## Safety notes
 
 - CI does NOT run on push — only manual dispatch. This prevents unintended ISO builds.
-- Internet Archive upload uses a unique identifier per run, so re-running CI won't overwrite a previous release.
-- Both `IA_ACCESS_KEY` and `IA_SECRET_KEY` must be set as repo secrets for the upload step to succeed.
+- Internet Archive upload is disabled by default; when enabled it uses a unique identifier per run, so re-running CI won't overwrite a previous release.
+- `GROQ_API_KEY` must be set as a repo secret for the AI moderator to function.