fix(live-usb): use baked-in UUIDs for ESP/LIVE search (label lookups fail on real HW)

Real UEFI hardware v2.12.7/v2.12.8 still landed in the grub> rescue
shell, and the user reported the same happening in legacy BIOS mode
too — both code paths share the /boot/grub/grub.cfg which begins with
`search --no-floppy --label LIVE --set=live`. If that label lookup
fails (some firmware doesn't surface FAT/ext4 labels, or the firmware
exposes the disk through a path GRUB's label table doesn't recognise)
\$live stays unset, every menuentry's `linux (\$live)/live/vmlinuz`
becomes `linux ()/live/vmlinuz`, the kernel doesn't load, GRUB
drops the operator at the rescue prompt. Same root cause as the
EFI embed-cfg's `search --label ESP` failure.

Capture the ESP + LIVE UUIDs with blkid right after mkfs.* and
substitute them into both configs:

  * grub.cfg uses `search --fs-uuid <LIVE_UUID> --set=live` as
    primary; falls back to `search --label LIVE` for firmware that
    DOES prefer labels (no-op if UUID already resolved).
  * embed-cfg uses `\$cmdpath/grub.cfg` first, then falls back to
    `search --fs-uuid <ESP_UUID>` + configfile from that root.

UUIDs are deterministic at build time, can't be shadowed by similarly
labelled partitions, and don't depend on the firmware's label
indexing — should work on any firmware that surfaces the disk to
GRUB's block IO at all.

image/build-live-usb.sh

@@ -3521,6 +3521,17 @@ else
   fi
 fi
 
+# Capture UUIDs — labels failed to resolve on at least one real UEFI
+# box (v2.12.x grub> shell symptom). Bake UUIDs into the embed-cfg
+# and grub.cfg so `search --fs-uuid` is used everywhere instead of
+# the fragile `search --label`. blkid is read AFTER mkfs.* so the
+# values are guaranteed fresh.
+udevadm settle 2>/dev/null || sleep 1
+ESP_UUID=$(blkid -s UUID -o value "${LOOP}p2" 2>/dev/null || echo "")
+LIVE_UUID=$(blkid -s UUID -o value "${LOOP}p3" 2>/dev/null || echo "")
+[[ -z "$ESP_UUID" || -z "$LIVE_UUID" ]] && err "Failed to read ESP/LIVE UUIDs from ${LOOP} after mkfs"
+log "ESP UUID=${ESP_UUID} LIVE UUID=${LIVE_UUID}"
+
 # Mount for file copy
 MNT="${WORK_DIR}/mnt"
 mkdir -p "${MNT}/esp" "${MNT}/live"
@@ -3571,7 +3582,15 @@ insmod all_video
 insmod echo
 insmod gfxterm
 
-search --no-floppy --label LIVE --set=live
+# Resolve LIVE partition by UUID — `search --label` failed silently on
+# real UEFI hardware (v2.12.x grub> shell). UUIDs are baked at build
+# time from blkid after mkfs.ext4, so this lookup is deterministic.
+search --no-floppy --fs-uuid ${LIVE_UUID} --set=live
+# Fallback: keep the label search as a second chance for firmware
+# that prefers labels (no-op if already set above).
+if [ -z "\$live" ]; then
+    search --no-floppy --label LIVE --set=live
+fi
 
 # CRT-style menu colors (cyan on black, gold highlights)
 set menu_color_normal=cyan/black
@@ -3699,8 +3718,17 @@ cp "${MNT}/esp/boot/grub/grub.cfg" "${MNT}/esp/EFI/BOOT/grub.cfg"
 # unchanged.
 GRUB_MODS="part_gpt part_msdos fat ext2 normal linux boot configfile loopback chain efi_gop efi_uga ls search search_label gfxterm all_video"
 
-cat > "${WORK_DIR}/grub-embed.cfg" <<'EMBEDCFG'
-configfile $cmdpath/grub.cfg
+cat > "${WORK_DIR}/grub-embed.cfg" <<EMBEDCFG
+# Try \$cmdpath first (set by firmware to dir of loaded .EFI). Falls
+# back to UUID-based search if \$cmdpath isn't usable.
+if [ -n "\$cmdpath" ]; then
+    configfile \$cmdpath/grub.cfg
+fi
+search --no-floppy --fs-uuid ${ESP_UUID} --set=root
+if [ -n "\$root" ]; then
+    configfile (\$root)/EFI/BOOT/grub.cfg
+fi
+echo "GRUB embed-cfg fallback failed: cmdpath=\$cmdpath root=\$root"
 EMBEDCFG
 
 grub-mkimage -o "${MNT}/esp/EFI/BOOT/BOOTX64.EFI" \