installer-iso: clone the (now public) repo fresh at boot, not baked in

require_tracked() in scripts/deploy now skips its git-tracked-file check
when there's no .git at all (nothing can be untracked in that case) — needed
for an earlier baked-in-`self` approach and kept as a generic fallback.

Since the repo is public now, installer-iso instead clones current master
via a homelab-checkout.service (after network-online.target) on every boot,
to /root/homelab. One ISO build stays useful indefinitely instead of going
stale, and there's still no rsync-the-repo-over step.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

flake.nix

@@ -162,7 +162,12 @@
           ];
         };
 
-        # Bootable USB recovery installer with our SSH key + sshd + DHCP.
+        # Bootable USB recovery installer with our SSH key + sshd + DHCP. Clones
+        # the (now public) homelab repo fresh at every boot to /root/homelab —
+        # always current master, so the same USB stick stays useful across
+        # install/rescue occasions without ever needing a rebuild. No
+        # rsync/copy-the-repo-over step: boot it, ssh in,
+        # `cd /root/homelab && ./scripts/deploy install ...`.
         # Reusable for any host's manual-USB install path (jupiter, terra, ...).
         # Build the ISO:
         #   nix build .#nixosConfigurations.installer-iso.config.system.build.isoImage
@@ -179,6 +184,27 @@
               ];
               networking.hostName = "homelab-installer";
               environment.systemPackages = [ pkgs.git ];
+
+              # Fresh clone of a PUBLIC repo — no credentials baked into the
+              # ISO. require_tracked() in scripts/deploy still works fine here
+              # (this IS a real git checkout, unlike the old baked-`self`
+              # approach), but retry manually with `systemctl restart
+              # homelab-checkout` if DHCP was still coming up at boot.
+              systemd.services.homelab-checkout = {
+                description = "Clone the homelab repo to /root/homelab";
+                after = [ "network-online.target" ];
+                wants = [ "network-online.target" ];
+                wantedBy = [ "multi-user.target" ];
+                path = [ pkgs.git ];
+                serviceConfig = {
+                  Type = "oneshot";
+                  RemainAfterExit = true;
+                };
+                script = ''
+                  rm -rf /root/homelab
+                  git clone --depth 1 https://git.mgaction.town/darman/homelab.git /root/homelab
+                '';
+              };
             })
           ];
         };