Summary

This PR carries the current elizaOS Live Linux/Tails-derived USB work on the clean nubs/messylinux branch.

It includes:

• elizaOS Live branding and desktop/app integration
• root-mode boot fix for / and /run/nosymfollow after systemd-tmpfiles-setup.service
• removal of the temporary D-Bus/polkit working-directory workaround path
• update verifier/health-check pre-persistence path hardening
• source smoke/security checks for the root-mode, updater, persistence, privacy, and capability boundaries
• docs for current validation state, production gaps, signed app/runtime updates, model catalog, and distribution/update strategy

Validation

Latest current-HEAD ISO artifact tested locally:

2ff679a74464dd1ad37c0202b58fc56c5dd64b6e9ce047945d6ee60fcb139faa

QEMU normal boot of that artifact reached:

• elizaOS greeter
• normal GNOME desktop
• elizaOS app window on the desktop

Post-rebase checks:

• ELIZAOS_STATIC_SOURCE_ONLY=1 ./scripts/static-smoke.sh passed
• ./scripts/security-smoke.sh passed with 2 expected production warnings: missing production update keyring and missing SBOM/provenance artifacts

Still Not Claimed

This is demo/productization work, not a final enterprise release. Remaining proof before calling the USB demo final:

• repeat guarded USB flash/readback for the 2ff679a7... artifact
• boot the USB on real hardware
• validate real USB Persistent Storage create/unlock/delete behavior
• validate privacy/direct networking behavior for app, renderer, embedded browser, and OAuth/external web surfaces
• add production release keyring, SBOM, provenance, downloader, revocation, and rollback promotion policy before production claims