Align installer defaults with ISO policy

[DigitalPals]

Checkout installations could select different authentication, personal-setting, and automatic-login defaults from the ISO. Both paths now consume a shared installation policy, with the current ISO defaults authoritative and automatic login gated on verified root encryption. Reconfiguration preserves saved choices, and personal files are seeded only when absent.

Add behavioral parity regressions to both required CI suites. Update AGENTS.md and installation/release documentation to require equivalent outcomes for both paths, comparisons from the same revision, and fresh ISO/RPM qualification when the installed payload changes. Source-release and RPM delivery mechanisms remain separate.

Validation:

• Full source suite (./tests/run) and image source checks (python3 -B image/check-source) passed locally.
• Focused policy, configuration, preservation, syntax, and static-analysis checks passed after the final edits.
• No ISO was rebuilt or deployed; fixture results do not constitute end-to-end installation qualification. The live Quickshell lifecycle smoke was skipped because the managed shell is running.