Merge nucleic/lucid-lunar-wren-wxyw into dev

mkimage/profiles/vm.pkgs

@@ -0,0 +1,22 @@
+# naros-vm headless tier — bootable base + systemd (NAROS.md §7.4, milestone N4).
+#
+# The VM boots the naros base userspace with **systemd as PID 1** (§5: the VM flavor keeps
+# systemd). This list is deliberately just the bootable minimum: the base utility set plus
+# systemd/udev. Everything Nucleic-specific beyond the base layer — the vsock agent, the
+# `agent` sudoers, and (N5) the GNOME 50 desktop stack — arrives at FIRSTBOOT via
+# `apt install naros-tier-vm` (§7.4), NOT baked here.
+#
+# No linux-image: the VM boots an externally-sourced kernel + initrd whose matching modules
+# ride the two-phase payload (LINUX_VM.md; the kernel/initrd flow is a narOS non-goal to
+# change). A Debian kernel here would drag a whole second linux-image.
+ca-certificates
+curl
+git
+openssh-client
+iproute2
+# systemd as PID 1 + the networking/udev a bootable guest needs to reach the hosted apt
+# repo at firstboot. dbus/sudo are pulled in by naros-tier-vm, not baked.
+systemd
+systemd-sysv
+systemd-resolved
+udev