installer-iso: clone the (now public) repo fresh at boot, not baked in

require_tracked() in scripts/deploy now skips its git-tracked-file check
when there's no .git at all (nothing can be untracked in that case) — needed
for an earlier baked-in-`self` approach and kept as a generic fallback.

Since the repo is public now, installer-iso instead clones current master
via a homelab-checkout.service (after network-online.target) on every boot,
to /root/homelab. One ISO build stays useful indefinitely instead of going
stale, and there's still no rsync-the-repo-over step.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/deploy

@@ -98,6 +98,10 @@ kexec_artifacts() {
 require_tracked() {
   local config="$1" cfgfile="hosts/$1/configuration.nix"
   [ -e "$cfgfile" ] || die "no $cfgfile in the repo"
+  # No .git at all (e.g. a tarball export of the repo, no working tree) means
+  # there's nothing that CAN be untracked — nothing to check. Only skip on a
+  # MISSING .git, not on any other git failure.
+  git -C "$REPO" rev-parse --is-inside-work-tree >/dev/null 2>&1 || return 0
   git -C "$REPO" ls-files --error-unmatch "$cfgfile" >/dev/null 2>&1 \
     || die "$cfgfile is untracked — 'git add hosts/$config' first (flakes ignore untracked files)"
 }