feat(bypass): data-driven DLL bypass policy + fix RCLONE_CONF required

Add scripts/build/bypass_policy.py which reads the needs_dll_bypass
flag from editions.yaml to determine whether a product+edition needs
the DLL patch (Layer 2) in addition to the always-on registry tweak
(Layer 1). This replaces the previous stage-if-dir-exists logic:

- Editions with needs_dll_bypass=true (Enterprise, Enterprise N, IoT
  Enterprise LTSC on 24H2/25H2) stage DLLs + patch WIM
- Editions without the flag (Pro, Home, Education, etc.) skip DLL
  steps entirely, registry-only bypass (saves WIM mount/unmount time)
- Editions that need DLLs but bypass/product/ is empty fail the build
  with a clear error pointing to bypass/README.md

editions.yaml changes:
- win11-24h2: enterprise + enterprisen flagged needs_dll_bypass=true
- win11-25h2: enterprise + iotenterprise flagged
- win11-ltsc: iotenterprise flagged
- win10-22h2: no flags (Win10 has no hardware check)

build.yml changes:
- New Check Win11 bypass policy step runs bypass_policy.py and sets
  action=skip|patch|fail as a step output
- DLL staging step gated on action==patch (was: if dir exists)
- RCLONE_CONF secret changed from required:true to required:false
  (gofile is the default upload target; rclone is opt-in)

Also includes uncommitted work from prior session:
- repack.sh: improved genisoimage comments + explicit warnings
- tests/test_repack_uefi.py: 6 per-builder UEFI bootability tests

Fixes stale docstring in bypass_win11_requirements.py that still
referenced the removed BYPASS_DLLS_B64 secret pattern.

Tests: 144 passed, 6 skipped (was 128 passed).

Release v1.4.5

- fix(repack): drop --grub2-boot-info (was silently dropping EFI
  entry, leaving UEFI systems unable to boot the ISO)

Release v1.4.4

- feat(drivers): pull SetupRST.exe from win-forge/winforge release
  (fixes Intel CDN WAF issue that was silently skipping RST
  driver injection on every build)

Release v1.4.3

- fix(build): install rclone as a system dep (was missing from
  the apt-get list, causing 'command not found' exit 127 in the
  rclone upload step)

Release v1.4.2

- fix(bypass): correct wimlib-imagex CLI flags (was using
  --readwrite on mount and --discard on unmount, neither of which
  is a real flag for wimlib-imagex)

Release v1.4.1

- chore(deps): bump runtime + dev deps to match open Dependabot PRs
- chore(deps): bump actions/upload-artifact from v4 to v7
- fix: pre-existing ruff/mypy lint errors (unused import, [no-any-return])

fix(build): install rclone as a system dep

The 'Upload ISO to Google Drive' step shells out to rclone but the
ubuntu-latest runner doesn't ship rclone pre-installed and the
'Install system deps for UUP conversion' step was missing it from
the apt-get list. Build failed with exit 127 (command not found)
on the rclone step.

Caught by a real build run on v1.4.1; the bypass and gofile
steps ran fine on v1.4.2 once the missing dep was the only
remaining blocker.

Release v1.4.0

Adds:
- Gofile.io upload (scripts/gofile/)
- Win11 system-requirement bypass (registry + DLL patch)
- gofile links surfaced in Actions step summary + step outputs

feat: check-updates writes to products.yaml; on-push-products trigger…

…s rebuilds

Wire the auto-update flow end-to-end:
1. check-updates scrapes UUP-dump, matches against config/products.yaml
2. If any product has a new UUID, opens a PR updating products.yaml in-place
   (the old design dropped a manifest in manifests/ that nothing consumed)
3. on-push-products watches products.yaml changes on main; when one is merged
   it dispatches product-updated to phantomic12/winforge-configs via the
   WINFORGE_CONFIGS_TOKEN secret
4. winforge-configs on-product-updated resolves the changed products against
   its own config/profiles/ and dispatches build-request for each match

The full chain: UUP-dump release -> check-updates PR -> merge -> dispatch ->
rebuild. Manual override: edit config/products.yaml directly and the same
chain fires.

fix: keep default checkout at repo root; .winforge is a symlink to .

Previously the workflow checked out the caller into ./caller/ which
broke actions/setup-python@v6's 'cache: pip' feature — that action
walks the working tree for pyproject.toml and can't find it under caller/.

New design: default checkout stays at the root. .winforge is:
- a symlink to . in self-build mode (where the default checkout IS winforge)
- a real checkout of phantomic12/winforge in caller mode

This means the rest of the build can use .winforge/scripts/...
unconditionally. Removed all the 'if [ -d .winforge' branches that
toggled between .winforge/scripts/ and scripts/ paths.

Also fixed cache-dependency-path for setup-python so it finds
.winforge/pyproject.toml in caller mode and ./pyproject.toml in
self-build mode (the symlink target).