Add offline Workstation payload foundation

autoinstall/offline/README.md

@@ -0,0 +1,33 @@
+# Nexus One AI Offline Server Payload
+
+This directory defines the payload embedded by `build-iso-offline.sh`. The
+offline installer is deliberately separate from the existing online bootstrap
+ISO until disconnected clean-install validation is complete.
+
+## Offline Workstation contents
+
+- the exact `aipackage` source revision used for the build
+- Ubuntu, Docker, NVIDIA and appliance `.deb` packages
+- Python wheels for the backend, RAG, ChromaDB and optional JupyterLab
+- Miniconda installer and an offline Python 3.11 environment package
+- Ollama runtime with `phi3:mini` and `nomic-embed-text`
+- vLLM and web/monitoring container images
+- the pinned Phi-3 Hugging Face model snapshot used by vLLM
+- K3s, MinIO and `mc` binaries for update/model packs (not enabled by Starter)
+- SHA-256 manifests and build provenance
+
+Server L/Max models are intentionally separate signed model packs. Optional external
+connectors cannot operate without a customer-approved route to their target.
+
+## Build stages
+
+1. On a connected Ubuntu 22.04 staging host with at least 80 GiB free, run
+   `sudo bash autoinstall/offline/build-bundle.sh`.
+2. Review `autoinstall/offline-output/manifest/` and sign
+   `SHA256SUMS` with the release key.
+3. Run `sudo bash autoinstall/build-iso-offline.sh` to inject the verified
+   payload into the Ubuntu Server ISO.
+4. Validate with all network interfaces disconnected.
+
+The bundle builder fails closed when an expected payload is absent. An ISO must
+not be labelled offline merely because the source tree was embedded.