feat: QEMU headless boot test in CI, updated skills + references

CI now runs a headless QEMU boot test after the smoke test:
- Boots ISO with -nographic, captures serial output
- Watches for "Press Enter to start installation" (pass)
- Detects kernel panic or initramfs shell (fail)
- 120 second timeout, runs as continue-on-error

Also: updated iso-debug reference with embedded vs appended EFI
findings from real hardware testing.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.claude/skills/iso-debug/references/boot-chain-reference.md

@@ -18,6 +18,22 @@ The first 432 bytes of a hybrid-bootable ISO. Contains the Master Boot Record co
 
 **Rule**: Always extract MBR from a known-working ISO. Never rely on the generic ISOLINUX one.
 
+### CRITICAL: Embedded vs Appended EFI — Real Hardware Impact
+
+Two approaches for EFI boot in xorriso. They produce DIFFERENT hybrid structures:
+
+| Approach | xorriso flag | cyl-align | CHS geometry | Real hardware |
+|----------|-------------|-----------|--------------|---------------|
+| **Embedded** | `-e boot/grub/efi.img` | `cyl-align-on` | Non-zero (e.g. 244/32) | **WORKS** |
+| **Appended** | `-append_partition 2 ... -e --interval:appended_partition_2:all::` | `cyl-align-off` | `0/0` | **FAILS** |
+
+The Will Haley guide recommends appended, but on our Dell hardware only embedded works.
+Use `xorriso -indev image.iso -report_system_area plain` to check which mode an ISO uses.
+
+### Common gotcha: installer minbase missing sudo
+debootstrap --variant=minbase does NOT include sudo. If the installer runs as root
+(via auto-login), do NOT use sudo in scripts. `bash: sudo: command not found` is the symptom.
+
 ### xorriso flags for hybrid boot
 ```bash
 xorriso -as mkisofs -o output.iso \