Fix dev/prod split and dev ISOs; consolidate zero-touch installer

- Wire -dev variants to the radiantwave-dev input (?ref=dev); prod keeps main
- Fix android-dev upgradeFlakeRef (was upgrading into production config)
- Parameterize one installer module (zero-touch-installer.nix); replace the
  four near-duplicate ISO configs; mkIso pairs each ISO with its closure +
  disk layout, fixing commercial-dev/android-dev ISO eval errors
- Add missing packages outputs (commercial-dev, android-dev, rpi, rpi-dev)
- Set networking.hostName + system.configurationRevision per variant
- Remove gitea access token and dead netrc/JWT config (repos are public)
- Drop flake.lock update step from CI (lock updates are manual)
- Refresh AGENTS.md: variants/ISO tables, facter report procedure, gotchas

.gitea/workflows/build-dev.yml

@@ -4,17 +4,15 @@ on:
   workflow_dispatch:
 
 jobs:
-  update-and-build:
+  build-dev-iso:
     runs-on: build-server
 
     steps:
       - name: Checkout
         run: git clone --depth 1 ssh://git@gitea.radiantwavetech.com:2222/RadiantWaveTech/KioskConfig.git .
 
-      - name: Update radiantwave-dev
-        run: |
-          . /nix/var/nix/profiles/default/etc/profile.d/nix-daemon.sh
-          nix flake update radiantwave-dev
+      # flake.lock is updated manually (committing an updated lock is the
+      # release trigger); CI only builds what is checked in.
 
       - name: Prepare output directory
         run: mkdir -p /home/user/radiantwave