feat: add dual-mode ISO builds (production vs demo) with serial console

Two build modes:
- `./run.sh iso` — production ISO (prompts for credentials, quiet boot)
- `./run.sh iso:demo` — demo/CI ISO (hardcoded test credentials, serial
  console output, verbose kernel)

Changes:
- run.sh: Accept iso:demo subcommand, pass KNEL_BUILD_MODE to Docker
- run.sh: Demo mode uses verbose kernel cmdline with console=ttyS0
- config/bootloaders/grub-pc/config.cfg: GRUB serial console on ttyS0
  at 115200 baud alongside VGA gfxterm (dual output)
- config/includes.installer/demo.preseed.cfg: Fully automated preseed
  with hardcoded test credentials (NOT for production use)
- config/hooks/binary/0199-serial-console.hook: Ensures serial console
  on Debian installer entries too
- .gitignore: Fix binary/ pattern to /binary/ (was matching config/hooks/binary/)

Demo credentials (TESTING ONLY):
- User: football / Kn3l-F00tball-D3m0!
- Root: Kn3l-R00t-D3m0!
- LUKS: Kn3l-D3m0-LUKS!

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

config/bootloaders/grub-pc/config.cfg

@@ -0,0 +1,32 @@
+set default=0
+
+# Serial console for demo/validation mode
+serial --speed=115200 --unit=0 --word=8 --parity=no --stop=1
+terminal_input serial_console console
+terminal_output gfxterm serial_console
+
+if [ x$feature_default_font_path = xy ] ; then
+    font=unicode
+else
+    font=$prefix/unicode.pf2
+fi
+
+if loadfont $font ; then
+    set gfxmode=800x600
+    set gfxpayload=keep
+    insmod efi_gop
+    insmod efi_uga
+    insmod video_bochs
+    insmod video_cirrus
+else
+    set gfxmode=auto
+    insmod all_video
+fi
+
+insmod gfxterm
+insmod png
+
+source /boot/grub/theme.cfg
+
+insmod play
+play 960 440 1 0 4 440 1