Integrate verified Pi kiosk release-readiness work
All checks were successful
CI / verify (pull_request) Successful in 8s
Harden Pi updater, release workflows, and isolated PR CI
Some checks failed
CI / verify (pull_request) Failing after 4s