Flashable Pi image: blank SD card to pairing QR with no terminal

## Why (bench evidence, 2026-08-14)
\`castor up\` gets a configured host to ~1 minute — but only once Python, pip, and opencastor exist. For the stated goal (**robot up in <10 min, inexperienced people**), the clock starts at a blank SD card, and \`pip install opencastor\` on a fresh Pi eats 10+ minutes alone. The 2.7 GB qwen3.5:2b pull eats most of another ten on home Wi-Fi.

## What
A Raspberry Pi Imager preset (custom OS image or cloud-init overlay):
- OpenCastor + robot-md-gateway + rc-car-actuator preinstalled in a venv
- Ollama preinstalled with **qwen3.5:2b pre-pulled** into the image
- First-boot service runs \`castor up --home ~/robot\` and serves the pairing QR at \`http://robot.local\` (and on any attached display)
- Wi-Fi/hostname via the Imager's standard customization

## Acceptance
- Flash → boot → scan → app paired, in under 10 minutes wall-clock on a Pi 5, measured
- No SSH, no terminal, no typed command anywhere in the path
- \`castor gaps\` empty-or-explained on first boot

## Pointers
- \`castor/up.py\` (idempotent bring-up, opencastor-runtime 2aa048f/4411b9d)
- \`castor pair --out-dir\` writes pair-qr.png + payload (d272b70)
- rc-car-actuator must be on PyPI first (see publish-chain issue)

Start with castor/up.py and the referenced opencastor-runtime revisions, then inspect castor pair --out-dir and the rc-car-actuator publish-chain dependency. Done means a Pi 5 can go from flashing to app pairing in under 10 minutes without SSH or terminal commands, with castor gaps empty or explained on first boot.

Written by the indexing model from the issue text.