feat: add dual-mode ISO builds (production vs demo) with serial console

Two build modes:
- `./run.sh iso` — production ISO (prompts for credentials, quiet boot)
- `./run.sh iso:demo` — demo/CI ISO (hardcoded test credentials, serial
  console output, verbose kernel)

Changes:
- run.sh: Accept iso:demo subcommand, pass KNEL_BUILD_MODE to Docker
- run.sh: Demo mode uses verbose kernel cmdline with console=ttyS0
- config/bootloaders/grub-pc/config.cfg: GRUB serial console on ttyS0
  at 115200 baud alongside VGA gfxterm (dual output)
- config/includes.installer/demo.preseed.cfg: Fully automated preseed
  with hardcoded test credentials (NOT for production use)
- config/hooks/binary/0199-serial-console.hook: Ensures serial console
  on Debian installer entries too
- .gitignore: Fix binary/ pattern to /binary/ (was matching config/hooks/binary/)

Demo credentials (TESTING ONLY):
- User: football / Kn3l-F00tball-D3m0!
- Root: Kn3l-R00t-D3m0!
- LUKS: Kn3l-D3m0-LUKS!

💘 Generated with Crush

Assisted-by: GLM-5.1 via Crush <crush@charm.land>

config/hooks/binary/0199-serial-console.hook

@@ -0,0 +1,19 @@
+#!/bin/bash
+set -e
+
+echo "Adding serial console to Debian installer boot entries..."
+
+GRUB_DIR="binary/boot/grub"
+
+for cfg in "$GRUB_DIR"/install.cfg "$GRUB_DIR"/install_start.cfg "$GRUB_DIR"/install_start_gui.cfg "$GRUB_DIR"/install_start_text.cfg; do
+    if [ -f "$cfg" ]; then
+        sed -i 's/@APPEND_INSTALL@/& console=ttyS0,115200/g' "$cfg" 2>/dev/null || true
+        sed -i 's/--- quiet/--- quiet console=ttyS0,115200/g' "$cfg" 2>/dev/null || true
+    fi
+done
+
+if [ -f "$GRUB_DIR/grub.cfg" ]; then
+    sed -i 's/@APPEND_LIVE@/& console=ttyS0,115200 console=tty0/g' "$GRUB_DIR/grub.cfg" 2>/dev/null || true
+fi
+
+echo "Serial console added to all boot entries."