When the DHCP-provided nameserver fails (QEMU 10.0.2.3, slow/broken DNS), first-login.sh would spin forever waiting for network. Add a live-setup.sh step that replaces 10.0.2.3 with 8.8.8.8/1.1.1.1 so first-login always has working DNS immediately on login.