Merge nucleic/lucid-lunar-wren-wxyw into dev

mkimage/hooks/00-identity.sh

@@ -6,6 +6,15 @@
 set -eu
 R="$1"
 
+# VARIANT is the os-release identity class (base/agent/runner/vm, §2.3); the build passes it
+# separately from NAROS_TIER so the two VM flavors (vm, vm-desktop) both report VARIANT=vm and
+# carry the headless/desktop distinction in NAROS_FLAVOR. Fallback to the tier for older callers.
+VARIANT="${NAROS_VARIANT:-$NAROS_TIER}"
+FLAVOR="${NAROS_FLAVOR:-}"
+# naros-init/systemd role: the VM tiers boot as a guest (systemd PID 1, §5); everything else is
+# a container surface.
+case "$VARIANT" in vm) ROLE="vm" ;; *) ROLE="container" ;; esac
+
 # mmdebstrap writes every build source into the target's sources.list — including the
 # CI-local [trusted=yes] copy:// pool, which doesn't exist at runtime and would fail
 # every `apt update` in a running container. Keep only the real mirrors (the pinned
@@ -21,8 +30,8 @@ ID_LIKE=debian
 VERSION_ID="$NAROS_VERSION"
 VERSION="$NAROS_VERSION ($NAROS_CHANNEL)"
 VERSION_CODENAME=$NAROS_SUITE
-VARIANT="$NAROS_TIER"
-VARIANT_ID=$NAROS_TIER
+VARIANT="$VARIANT"
+VARIANT_ID=$VARIANT
 HOME_URL="https://github.com/abkslm/nucleic"
 DOCUMENTATION_URL="https://github.com/abkslm/nucleic/blob/main/docs/NAROS.md"
 EOF
@@ -30,7 +39,7 @@ EOF
 mkdir -p "$R/etc/naros"
 echo "$NAROS_CHANNEL" > "$R/etc/naros/channel"
 echo "$NAROS_SNAPSHOT" > "$R/etc/naros/snapshot-date"
-echo "container" > "$R/etc/naros/role"
+echo "$ROLE" > "$R/etc/naros/role"
 
 # Capability manifest (NAROS.md §6.3). Base fields here; toolchain entries are appended
 # by the tiers that install them (agent-tier hook, N2). Versions of Nucleic packages are
@@ -43,6 +52,8 @@ cat > "$R/etc/naros/manifest.json" <<EOF
   "version": "$NAROS_VERSION",
   "channel": "$NAROS_CHANNEL",
   "tier": "$NAROS_TIER",
+  "variant": "$VARIANT",
+  "flavor": "$FLAVOR",
   "arch": "$NAROS_ARCH",
   "debian": { "suite": "$NAROS_SUITE", "snapshot": "$NAROS_SNAPSHOT" },
   "nash": $nash_ver,