Make Fedora live media a mutable SOS development environment

[devteapot]

Summary

Turns the diskless Fedora Workstation remix into the reusable SOS hardware-development environment and keeps release promotion as a separate future concern.

There are two image classes only:

1. development-live: mutable Fedora + GNOME/GDM + SOS + SSH, always promotion_eligible=false.
2. future release: immutable SOS-only artifact with its own artifact-matched release gate.

There is no acceptance-live artifact. Ordinary SOS patches can be built locally and deployed into the running live overlay instead of rebuilding and reflashing a ~3 GB ISO. #10 is merged and this PR is based directly on main.

Development-live design

• Pins the official Fedora ISO to its signed CHECKSUM digest.
• Handles Fedora 44's flat EROFS rootfs while preserving and auditing ownership, modes, ACLs, xattrs, capabilities, and SELinux labels.
• Preserves hybrid BIOS/UEFI boot and the Fedora volume label, then re-implants and verifies the embedded media checksum.
• Installs openssh-server, permits password SSH only for liveuser, disables root SSH, removes reusable host keys, and opens Fedora's SSH firewall service.
• Requires the development password through a private non-symlink file; plaintext is never written to metadata or command output.
• Uses Fedora's derived-spin livesys-session-extra hook after Fedora creates liveuser: assign the baked SHA-512 password hash, relock root, and disable GNOME live autologin.
• Does not enable SSH in the offline rootfs. The hook runs systemctl enable --now sshd.service as its final fail-closed action, after all account and GDM provisioning succeeds.
• Optionally accepts a private NetworkManager Wi-Fi keyfile, validates autoconnect and boot-time PSK availability, and installs it root-owned mode 0600.
• Network identity records only wifi_autoconnect and network_credentials_embedded; it never records the SSID or PSK.
• Credentialed development ISOs are private: anyone holding the image can extract an equivalent Wi-Fi credential. The future release must exclude this profile.
• Labels matching rootfs/ISO identities development-live, mutable_runtime=true, and promotion_eligible=false.
• Adds tools/linux-live-deploy for compositor, experience-host, provider, supervisor, session, and authoring binaries.
• The deployer refuses non-development media and a running SOS session, records base/source revision and dirty state, installs root-owned overlay files, and verifies every remote SHA-256.
• The hardware harness verifies deployment metadata and snapshots current SOS bytes against the baked manifest.
• A complete development campaign emits DIAGNOSTIC_PASS promotion_eligible=false; it can never emit the promotion-style PASS line.

Runtime fixes from the Framework loop

• Advertises Linux dmabuf formats independently of optional EGL_WL_bind_wayland_display, retaining wl_shm fallback.
• Routes raw touchscreen contacts to native text fields and coalesces touch-only host wakes.
• Preserves newer native text while serialized authority catches up and restores activation focus once without stealing normal field transfers.
• Retains calloop readiness, yields between bounded foreground batches, and services foreground work before deduplicated post-dispatch frames.
• Keeps Vulkan presentation out of Wayland protocol callbacks so touch cannot block action-result handling.
• Reaps an isolated host after unexpected proxy loss without overlapping a replacement.
• Hands logout to the lifecycle owner so supervisor and host stop before the compositor.
• Publishes a typed allowlist of trusted agent configuration actions.

Physical and host evidence

• Official Fedora Workstation 44 ISO: 2,851,612,672 bytes, SHA-256 1620295f6a00c27c3208f0c00b8ece4eab1ec69b9002152d97488bf26a426ddf.
• The successful f057d25 development ISO is 3,056,205,824 bytes, SHA-256 c2232111ab8b4aa6d55907dfdf5830a688468bf4be7b8dd218f26c727925ffc0; its embedded media checksum passes.
• The ISO was attached read-only through PiKVM and booted on the Framework Laptop 12. The root was a RAM-backed live overlay; the internal 1 TB Omarchy NVMe and both partitions had no mountpoints.
• GDM required the configured liveuser password. Fedora livesys assigned that password, relocked root, and disabled autologin.
• The boot exposed a real defect in the prior implementation: the baked lower rootfs contained the offline SSH enablement link and Requires=livesys.service drop-in, but the initial merged rootfs reported SSH inactive/disabled with no listener.
• A focused same-boot overlay proof removed that dependency and enabled/started SSH only after provisioning. Independent password SSH then passed; root was locked, liveuser had a password, per-boot host-key permissions were correct, and port 22 listened on IPv4 and IPv6.
• Commit 160c065 implements that proven SSH activation boundary.
• Commit 28cf8ff adds private Wi-Fi autoconnect. The actual profile created by the running Framework boot passed the no-secret validator and remains outside Git/evidence.
• The final host suites cover credentialed/uncredentialed identities, private input permissions, symlink rejection, disabled autoconnect, missing PSK, installed ownership/mode, SSH ordering, and diagnostic verdicts.
• linux_live_image_host_tests=PASS and linux_hardware_gate_host_tests=PASS; exact commands, timings, and evidence hashes are in docs/progress.md.

Release boundary and remaining validation

The f057d25 physical boot proves the original SSH failure and focused live-overlay correction. It does not prove the newly generated 28cf8ff hook and Wi-Fi profile on a fresh boot, and it is not release acceptance.

Bake the corrected clean revision with the private NetworkManager profile, attach it read-only, and cold-boot the Framework Laptop 12 without network HID input. Require automatic Wi-Fi activation, post-livesys SSH, password login, GDM GNOME/SOS selection, and the still-unmounted internal NVMe. Then deploy one changed binary, verify its digest, and run a same-boot diagnostic collection.

After that, ordinary runtime changes should reuse development-live. The future immutable SOS-only release composer and artifact-matched promotion gate remain intentionally separate; development diagnostic evidence cannot promote a release.