release: document v1.5.0-alpha unbundled ISO + sha256 + scp path

ISO itself stays out of git (2.4GB), but this pointer file records
the hash + retrieval path so anyone flashing to a fresh .253-style
install knows exactly what they're getting. Summary of code landed
in this ISO listed at the bottom so the changelog isn't scattered
across commit messages.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

releases/v1.5.0-alpha/ISO.md

@@ -0,0 +1,62 @@
+# Archipelago v1.5.0-alpha — Unbundled Installer ISO
+
+Built from `main @ 61679131` on 2026-04-19.
+
+## Artifact
+
+- **File:** `archipelago-installer-unbundled-x86_64.iso`
+- **Size:** 2,422,829,056 bytes (2.42 GB)
+- **SHA256:** `e33d0fae83d8ea8a71e33a1edd3ee4c1dbb5e0eb491ae61edcf0d5f51bf2c1c9`
+- **Mode:** UNBUNDLED — only `filebrowser` is bundled; all other apps install on-demand from the marketplace (requires internet after first boot).
+
+## Where to find it on the build host
+
+Not committed to git (too large). On `archi-thinkpad` (`192.168.1.116`):
+
+```
+/home/archipelago/Projects/archy/image-recipe/results/archipelago-installer-unbundled-x86_64.iso
+```
+
+## Grab it
+
+From another machine on the LAN:
+
+```bash
+scp archipelago@192.168.1.116:/home/archipelago/Projects/archy/image-recipe/results/archipelago-installer-unbundled-x86_64.iso .
+```
+
+## Flash to USB
+
+Either use the helper script:
+
+```bash
+sudo ./image-recipe/create-fat32-usb.sh /dev/sdX  # replace sdX
+```
+
+or Balena Etcher / Rufus / `dd`:
+
+```bash
+sudo dd if=archipelago-installer-unbundled-x86_64.iso of=/dev/sdX bs=4M status=progress conv=fsync
+```
+
+## What's in this ISO
+
+Everything committed through `main @ 61679131`:
+
+- FIPS-first transport for federation / messaging / peers / content / DWN sync
+- Settings per-service FIPS/Tor/Auto toggle
+- Transitive federation (peers-of-peers learned on state sync)
+- Own FIPS npub advertised in state snapshots (pre-v1.4 pairs auto-upgrade)
+- Cancel button for outbound pending peer requests + PeerCancel nostr message
+- Transport badge on federation node cards (FIPS / TOR / LAN / MESH)
+- Dedicated FIPS peer listener on `fips0:5679` with path whitelist
+- Lazy-bind peer listener: fips.install doesn't need archipelago restart
+- Self-add guard in peers (no more phantom self-peer entries)
+- Bidirectional `/network` peer requests (accept notifies the requester)
+- Multi-relay nostr kind:0 profile publish (publishes to every enabled
+  relay in Manage Relays, reports per-relay accept/reject)
+- Profile avatar + banner upload via `/api/blob`
+- nginx body-size raised to 256m on mesh/content/dwn locations
+- Deploy pipeline writes build-info.txt on every deploy (version
+  stays in sync with the binary's Cargo.toml)
+- nginx sites-enabled forced to symlink sites-available