Merge nucleic/lucid-lunar-wren-wxyw into dev

mkimage/profiles/vm.late-pkgs

@@ -0,0 +1,9 @@
+# Installed via dpkg -i in a finish hook, after every Debian package is configured
+# (build-rootfs.sh). nash-default-shell MUST be last-stage: its divert flips /bin/sh to
+# nash, and anything configured after the flip runs under nash — so the divert is the
+# image's final configure step (mirrors the base tier).
+#
+# naros-tier-vm is deliberately NOT here: it is apt-installed at firstboot from the hosted
+# repo (NAROS.md §7.4), which is what shrinks the provisioning script to the meta + glue.
+nash-default-shell
+naros-tier-base

mkimage/profiles/vm.naros-pkgs

@@ -0,0 +1,8 @@
+# Base Nucleic layer baked into the naros-vm rootfs so nash is the forced shell and the
+# hosted apt repo is trusted from the very first boot. The vsock agent (nucleic-linux-agent)
+# and the rest of the tier arrive at firstboot via `apt install naros-tier-vm` (NAROS.md
+# §7.4), so they are intentionally NOT baked here — this mirrors the base tier's layer.
+nash
+naros-init
+naros
+naros-keyring

mkimage/profiles/vm.pkgs

@@ -0,0 +1,22 @@
+# naros-vm headless tier — bootable base + systemd (NAROS.md §7.4, milestone N4).
+#
+# The VM boots the naros base userspace with **systemd as PID 1** (§5: the VM flavor keeps
+# systemd). This list is deliberately just the bootable minimum: the base utility set plus
+# systemd/udev. Everything Nucleic-specific beyond the base layer — the vsock agent, the
+# `agent` sudoers, and (N5) the GNOME 50 desktop stack — arrives at FIRSTBOOT via
+# `apt install naros-tier-vm` (§7.4), NOT baked here.
+#
+# No linux-image: the VM boots an externally-sourced kernel + initrd whose matching modules
+# ride the two-phase payload (LINUX_VM.md; the kernel/initrd flow is a narOS non-goal to
+# change). A Debian kernel here would drag a whole second linux-image.
+ca-certificates
+curl
+git
+openssh-client
+iproute2
+# systemd as PID 1 + the networking/udev a bootable guest needs to reach the hosted apt
+# repo at firstboot. dbus/sudo are pulled in by naros-tier-vm, not baked.
+systemd
+systemd-sysv
+systemd-resolved
+udev