fix(/): remove chmod blockers + broken less invoke from at-/ entries

MiOS = mios.git overlaid at /. The operator-facing entries are at
the root: ./install.sh, ./mios-pipeline.sh, just build, etc. Two
bugs were blocking those entries from running cleanly inside
MiOS-DEV after the quadlet-overlay seed populates /:

1. `just build` -> preflight recipe -> "chmod +x tools/preflight.sh"
   -> "Operation not permitted" when the operator (mios) isn't the
   file owner. Files at / are checked out by quadlet-overlay-seed
   running as root in the systemd-nspawn, so they're root-owned.
   Mios runs `just build`, hits chmod EPERM on a root-owned file,
   recipe aborts.

   The chmod was redundant anyway: tools/preflight.sh,
   tools/flight-control.sh, and tools/mios-overlay.sh are ALL
   stored in git's index as mode 100755 (executable). After
   `git reset --hard FETCH_HEAD` they're already +x; chmod is a
   no-op... that fails for non-owners. Removed all 5 chmod lines.

   Verified with `git ls-files -s tools/preflight.sh
   tools/flight-control.sh tools/mios-overlay.sh`:
       100755 6c5b115... tools/preflight.sh
       100755 9e8c28b... tools/flight-control.sh
       100755 4735f72... tools/mios-overlay.sh

2. `./install.sh` -> agreements banner -> less -> "Missing filename
   ("less --help" for help)" abort.

   The renderer in automation/lib/agreements-banner.sh was:
       mios_agreement_summary | less -RFXK <"$tty_in" >"$tty_out"
   The `<"$tty_in"` REPLACES the pipe's stdin with /dev/tty (a
   TTY, not piped data). less sees no filename arg AND no piped
   input, aborts. The intent was "read content from pipe, keyboard
   from /dev/tty" -- less does that automatically when stdin is a
   pipe. No `<` redirect needed.

After this commit:
  * `just preflight` works as mios (no sudo, no chmod EPERM)
  * `just build` proceeds past preflight
  * `./install.sh` renders the agreement banner cleanly, then
    hits its own EUID guard ("must run as root: sudo $0") which
    is correct behavior for a phase-3 system installer
  * `./mios-pipeline.sh` (the canonical operator entry per
    install.sh's v0.2.4+ NOTICE) gets the same fix free

Both fixes are at /-level operator entries. The deeper question
(should mios.git tracked files be mios-owned at /?) is a separate
design discussion and not touched here -- this commit is just to
unblock the entries that were already designed to work as mios.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: Kabuki94

Justfile

@@ -34,27 +34,22 @@ BIB := env_var_or_default("MIOS_BIB_IMAGE", MIOS_IMG_BIB)
 
 # Run preflight system check
 preflight:
-    @chmod +x tools/preflight.sh
     @./tools/preflight.sh
 
 # Show current flight status and variable mappings
 flight-status:
-    @chmod +x tools/flight-control.sh
     @./tools/flight-control.sh
 
 # Unified initialization (Mode 2: User-space)
 init:
-    @chmod +x tools/mios-overlay.sh
     sudo ./tools/mios-overlay.sh
 
 # System-wide deployment (Mode 1: FHS system install)
 deploy:
-    @chmod +x tools/mios-overlay.sh
     sudo ./tools/mios-overlay.sh
 
 # Live ISO Initiation (Mode 0: Overlay onto root)
 live-init:
-    @chmod +x tools/mios-overlay.sh
     sudo ./tools/mios-overlay.sh
 
 # bootc container lint -- runs against the locally built image.

automation/lib/agreements-banner.sh

@@ -175,7 +175,16 @@ _mios_agreement_render() {
         # -F  quit immediately if content fits on one screen
         # -X  do not clear the screen on exit
         # -K  abort on Ctrl-C without leaving terminal in alt screen
-        mios_agreement_summary | less -RFXK <"$tty_in" >"$tty_out"
+        #
+        # No `<"$tty_in"` redirect: the previous `cmd | less <"$tty_in"`
+        # form was wrong -- the `<` redirect REPLACES the pipe stdin,
+        # so less saw `</dev/tty` (a TTY, not piped data) AND no
+        # filename arg, then aborted with:
+        #   Missing filename ("less --help" for help)
+        # which is what the operator hit running ./install.sh from /
+        # inside MiOS-DEV. less reads keyboard input from /dev/tty
+        # automatically when stdin is a pipe; no override needed.
+        mios_agreement_summary | less -RFXK >"$tty_out"
     else
         mios_agreement_summary >"$tty_out"
     fi