installer-iso: clone the (now public) repo fresh at boot, not baked in

require_tracked() in scripts/deploy now skips its git-tracked-file check
when there's no .git at all (nothing can be untracked in that case) — needed
for an earlier baked-in-`self` approach and kept as a generic fallback.

Since the repo is public now, installer-iso instead clones current master
via a homelab-checkout.service (after network-online.target) on every boot,
to /root/homelab. One ISO build stays useful indefinitely instead of going
stale, and there's still no rsync-the-repo-over step.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -112,20 +112,20 @@ values. Nothing to fill in — just run it.
 > `lsblk -o NAME,SERIAL,SIZE,MODEL` before proceeding if the box's disks have
 > changed since `disk-config.nix` was written.
 
-1. Build the installer ISO and write it to a USB stick (from your laptop):
+1. Build the installer ISO and write it to a USB stick (from your laptop —
+   this only needs to be done once; the ISO clones current `master` fresh on
+   every boot, so the same stick stays useful indefinitely):
    ```
    nix build .#nixosConfigurations.installer-iso.config.system.build.isoImage
    sudo dd if=result/iso/*.iso of=/dev/sdX bs=4M status=progress conv=fsync
    ```
 2. Boot terra from the USB stick. It comes up with sshd + DHCP + your laptop
-   pubkey authorized for root, hostname `homelab-installer`.
-3. From your laptop, copy the repo onto the booted installer (it doesn't have
-   its own credentials for the private gitea repo, so push it over instead of
-   cloning from there):
-   ```
-   rsync -av /mnt/hdd_01/data/Dev/homelab/ root@<terra-installer-ip>:/root/homelab/
-   ```
-4. On terra (ssh'd in as root, or at the physical console):
+   pubkey authorized for root, hostname `homelab-installer`, and a
+   `homelab-checkout.service` that clones the (public) repo to
+   `/root/homelab` once network is up. If you ssh in before that finishes,
+   `systemctl status homelab-checkout` tells you; retry with
+   `systemctl restart homelab-checkout` if DHCP was still coming up at boot.
+3. SSH in (or use the physical console) and run the install directly:
    ```
    cd /root/homelab
    ./scripts/deploy install terra localhost
@@ -133,7 +133,7 @@ values. Nothing to fill in — just run it.
    `localhost`/`127.0.0.1` skips nixos-anywhere/ssh and runs disko +
    `nixos-install` directly against `/mnt`. Ships terra's pre-generated host
    key so `/run/secrets/*` decrypts on boot #1.
-5. Reboot into NixOS (remove the USB stick first). Then, same as any other
+4. Reboot into NixOS (remove the USB stick first). Then, same as any other
    host:
    ```
    ssh darman@terra sudo -v          # DO NOT SKIP — see below