feat: add dual-mode ISO builds (production vs demo) with serial console

Two build modes:
- `./run.sh iso` — production ISO (prompts for credentials, quiet boot)
- `./run.sh iso:demo` — demo/CI ISO (hardcoded test credentials, serial
  console output, verbose kernel)

Changes:
- run.sh: Accept iso:demo subcommand, pass KNEL_BUILD_MODE to Docker
- run.sh: Demo mode uses verbose kernel cmdline with console=ttyS0
- config/bootloaders/grub-pc/config.cfg: GRUB serial console on ttyS0
  at 115200 baud alongside VGA gfxterm (dual output)
- config/includes.installer/demo.preseed.cfg: Fully automated preseed
  with hardcoded test credentials (NOT for production use)
- config/hooks/binary/0199-serial-console.hook: Ensures serial console
  on Debian installer entries too
- .gitignore: Fix binary/ pattern to /binary/ (was matching config/hooks/binary/)

Demo credentials (TESTING ONLY):
- User: football / Kn3l-F00tball-D3m0!
- Root: Kn3l-R00t-D3m0!
- LUKS: Kn3l-D3m0-LUKS!

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

.gitignore

@@ -22,10 +22,10 @@ tmp/
 tmp2/
 output/
 
-# Live-build artifacts
-binary/
-.cache/
-bootstrap/
+# Live-build output artifacts (repo root only)
+/binary/
+/.cache/
+/bootstrap/
 
 # Temporary files
 *.log