chore: repo cleanup - pin actions, fix typos, improve gitignore

- build.yml: pin push-to-registry to SHA
- build-installer-iso.yml: pin checkout/upload-artifact to SHA,
  replace hardcoded registry with env vars, add env block
- Justfile: fix 'Virtal' typo (10x), fix shfmt error msg,
  quote $file in check/fix recipes
- .gitignore: add *.iso, *.qcow2, *.raw, .env, *.log
- iso/config.toml: remove leading space
- Containerfile: remove non-existent /tmp/build from cleanup
- build/50-prepare-flatpak-for-bazaar.sh: add executable permission
- build/README.md: update to reflect current script names

.gitignore

@@ -2,3 +2,9 @@ cosign.key
 _build_*
 output
 _build-*/**
+*.iso
+*.qcow2
+*.raw
+.env
+.env.*
+*.log