Merge nucleic/eager-ancient-heron-p5em into dev

mkimage/hooks/00-identity.sh

@@ -6,6 +6,12 @@
 set -eu
 R="$1"
 
+# mmdebstrap writes every build source into the target's sources.list — including the
+# CI-local [trusted=yes] copy:// pool, which doesn't exist at runtime and would fail
+# every `apt update` in a running container. Keep only the real mirrors (the pinned
+# snapshot); the hosted Nucleic repo arrives via naros-keyring's sources.list.d entry.
+sed -i '\#copy://#d' "$R/etc/apt/sources.list"
+
 rm -f "$R/etc/os-release"
 cat > "$R/etc/os-release" <<EOF
 NAME="narOS"

mkimage/profiles/agent.pkgs

@@ -1,3 +0,0 @@
-# naros-agent tier (NAROS.md §4, milestone N2 — placeholder until the agent tier lands).
-# Will carry: build-essential/pkg-config, python3 + pip/venv, the modern CLI kit, and the
-# hooks that add Node (NodeSource), rustup, Go, mise, warm caches, agent CLIs, Playwright.