initrd/bin/kexec-iso-init.sh: implement layered ISO boot with initrd compat check

Design overview
- Layer 1: initramfs filesystem compatibility check (check_initrd_fs_compat)
  Ensure the ISO's initrd contains kernel modules for the USB partition's
  filesystem before offering boot options.  Each unique initrd gets its own
  [OK]/[!] marker in /tmp/kexec_initrd_compat.txt.  Read-only filesystems
  (iso9660/squashfs/udf) skip the check (built-in kernel support).
- Layer 2: loopback.cfg fast path
  Parse GRUB ${iso_path}/${isofile} variables from the ISO's standard
  USB-boot config to extract kernel parameters.  Falls through to universal
  params if no GRUB vars found.  ADD is only set when GRUB variables are
  actually found to avoid blocking the universal fallback.
- Layer 3: kexec-select-boot.sh (interactive boot menu)

Parameter injection changes
- Replace fromiso= with findiso= (covers Debian live-boot + NixOS; fromiso=
  conflicts with findiso causing infinite loop device storms)
- Add live-media= device filter (for casper/live-boot)
- Retain iso-scan/filename= (Ubuntu casper, Fedora dracut), img_dev=,
  img_loop=, iso= (generic)
- Inject universal set unconditionally when loopback.cfg has no GRUB vars

Unsigned ISO warning improvements
- Separate signed, failed-signature, and unsigned flows with skip logic
- Include Recovery Shell instructions in wall message
- Improve whiptail and CLI prompt text

Minor changes
- Quote $MOUNTED_ISO_PATH, $ADD_FILE, $REMOVE_FILE, $paramsdir
- Replace backticks with $() for DEV_UUID
- Refine STATUS messages
- Remove stale comment about hash verification

Signed-off-by: Thierry Laurion <insurgo@riseup.net>

Author: tlaurion