Add dedicated Nexus One AI Workstation ISO build path

- New build-iso-workstation.sh / autoinstall/user-data-workstation: writes
  the workstation tier marker (/opt/cezen/tier), reuses the Server S
  (starter) hardware profile and Ansible playbook under the hood
- firstboot-setup.sh: additive WORKSTATION_MODE branch (gated on
  CEZEN_TIER=workstation) skips the Server tier-selection menu entirely —
  Workstation is never offered as a Server S/M/L/Max choice. Non-workstation
  installs are unaffected. Also relabels the Server tier menu to
  Server S/M/L/Max, matching the earlier portal rename
- install.sh and the Ansible playbooks are unchanged; only the pre/post
  marker files differ between a Server S and Workstation install
- README.md + MIGRATION_NOTES.md updated with the new build path and what
  is still manual (CEZEN_TIER isn't yet templated into the deployed
  cezen-api systemd unit — tracked as follow-up)

README.md

@@ -263,11 +263,22 @@ kept outside the Server ladder — see [Product Structure](#product-structure)):
 |---|---|---|---|
 | Workstation (`workstation`) | NVIDIA DGX Spark, RTX 5090 Workstation, or RTX PRO 6000 Workstation | Local chat, personal RAG, prompt studio, document intelligence | 1-3 active, 5 max |
 
-The compact single-GPU ISO build path (`build-iso-starter.sh` /
-`user-data-starter`) is the closest existing hardware profile to Workstation
-today. It still writes the `starter` (Server S) tier marker — repointing it to
-build a dedicated Workstation ISO is tracked as follow-up work, not done in
-this pass (see [Migration Notes](../MIGRATION_NOTES.md)).
+Build a dedicated Workstation ISO with:
+
+```bash
+bash autoinstall/build-iso-workstation.sh
+```
+
+This produces `autoinstall/cezen-ai-workstation-ubuntu2204.iso`, using
+`user-data-workstation` — same compact single-GPU hardware profile and
+Ansible playbook (`ansible/starter.yml`) as Server S under the hood, but a
+distinct `workstation` tier marker (`/opt/cezen/tier`) so the installed
+system brands and entitles itself as Nexus One AI Workstation. The first-boot
+wizard (`firstboot-setup.sh`) detects `CEZEN_TIER=workstation` and skips the
+Server tier-selection step entirely — Workstation is never offered as a
+Server S/M/L/Max choice. See [Migration Notes](../MIGRATION_NOTES.md) for
+what is and isn't wired up yet (live portal branding still needs a manual
+`CEZEN_TIER` override on the deployed service — see below).
 
 Large models can be pulled later. The ISO does not need to contain them.
 
@@ -449,14 +460,20 @@ codebase does and does not already provide (confirmed by direct inspection of
 cgit/
 ├── install.sh                         # Main installer entry point
 ├── autoinstall/                       # ISO first-boot setup and web setup
+│   ├── build-iso.sh                   # General multi-tier Server ISO builder
+│   ├── build-iso-starter.sh           # Server S compact single-GPU ISO builder
+│   ├── build-iso-workstation.sh       # Nexus One AI Workstation ISO builder
+│   ├── user-data-starter              # Server S autoinstall config
+│   ├── user-data-workstation          # Workstation autoinstall config
+│   └── firstboot-setup.sh             # TTY setup wizard (skips tier menu for Workstation)
 ├── scripts/cezen-feasibility.sh       # Existing-server feasibility checker
 ├── scripts/cezen-backup.sh            # Backup/restore helper
 ├── ansible/
 │   ├── phase1_nvidia.yml              # NVIDIA/CUDA phase
-│   ├── starter.yml                    # Starter tier
-│   ├── entry.yml                      # Entry/Basic tier
-│   ├── pro.yml                        # Pro tier
-│   ├── max.yml                        # Max tier
+│   ├── starter.yml                    # Server S tier (also used by Workstation)
+│   ├── entry.yml                      # Server M tier
+│   ├── pro.yml                        # Server L tier
+│   ├── max.yml                        # Server Max tier
 │   └── roles/
 │       ├── cezen-backend/             # FastAPI backend, cezen-api service
 │       ├── cezen-nginx/               # Portal/nginx deployment