migrate ISO build from Alpine to Debian 12 (Bookworm)

Replace the entire live CD build pipeline:
- Alpine SDK + mkimage + genapkovl → Debian live-build (lb config/build)
- OpenRC init scripts → systemd service units
- dropbear → openssh-server (native to Debian live)
- udhcpc → dhclient for DHCP
- apk → apt-get in setup-builder.sh and build-nvidia-module.sh
- Add auto/config (lb config options) and auto/build wrapper
- Add config/package-lists/bee.list.chroot replacing Alpine apks
- Add config/hooks/normal/9000-bee-setup.hook.chroot to enable services
- Add bee-nvidia-load and bee-sshsetup helper scripts
- Keep NVIDIA pre-compile pipeline (Option B): compile on builder VM against
  pinned Debian kernel headers (DEBIAN_KERNEL_ABI), inject .ko into includes.chroot
- Fixes: native glibc (no gcompat shims), proper udev, writable /lib/modules,
  no Alpine modloop read-only constraint, no stale apk cache issues

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

iso/builder/setup-builder.sh

@@ -1,10 +1,10 @@
 #!/bin/sh
-# setup-builder.sh — prepare Alpine VM as bee ISO builder
+# setup-builder.sh — prepare Debian 12 VM as bee ISO builder
 #
-# Run once on a fresh Alpine 3.21 VM as root.
-# After this script completes, the VM can build ISO images.
+# Run once on a fresh Debian 12 (Bookworm) VM as root.
+# After this script completes, the VM can build bee ISO images.
 #
-# Usage (on Alpine VM):
+# Usage (on Debian VM):
 #   wget -O- https://git.mchus.pro/mchus/bee/raw/branch/main/iso/builder/setup-builder.sh | sh
 #   or: sh setup-builder.sh
 
@@ -12,65 +12,41 @@ set -e
 
 . "$(dirname "$0")/VERSIONS" 2>/dev/null || true
 GO_VERSION="${GO_VERSION:-1.23.6}"
+DEBIAN_VERSION="${DEBIAN_VERSION:-12}"
+DEBIAN_KERNEL_ABI="${DEBIAN_KERNEL_ABI:-6.1.0-28}"
 
 echo "=== bee builder setup ==="
-echo "Alpine: $(cat /etc/alpine-release)"
+echo "Debian: $(cat /etc/debian_version)"
 echo "Go target: ${GO_VERSION}"
+echo "Kernel ABI: ${DEBIAN_KERNEL_ABI}"
 echo ""
 
 # --- system packages ---
-apk update
-# enable community repo if not already enabled
-sed -i 's|^#\(.*community\)|\1|' /etc/apk/repositories
+export DEBIAN_FRONTEND=noninteractive
+apt-get update -qq
 
-apk update
-apk add \
-    alpine-sdk \
-    abuild \
+apt-get install -y \
+    live-build \
+    debootstrap \
     squashfs-tools \
     xorriso \
+    grub-pc-bin \
+    grub-efi-amd64-bin \
     mtools \
-    grub \
-    grub-efi \
-    grub-bios \
     git \
     wget \
     curl \
     tar \
-    xz \
-    screen
+    xz-utils \
+    screen \
+    rsync \
+    build-essential \
+    gcc \
+    make \
+    perl \
+    "linux-headers-${DEBIAN_KERNEL_ABI}-amd64"
 
-# --- audit runtime packages (verify they exist in Alpine repos) ---
-echo ""
-echo "=== verifying audit runtime packages ==="
-RUNTIME_PKGS="
-    dmidecode
-    smartmontools
-    nvme-cli
-    pciutils
-    ipmitool
-    util-linux
-    e2fsprogs
-    qrencode
-    dropbear
-    udhcpc
-    pciutils-libs
-    lshw
-"
-MISSING=""
-for pkg in $RUNTIME_PKGS; do
-    if apk info --quiet "$pkg" 2>/dev/null || apk search --quiet "$pkg" 2>/dev/null | grep -q "^${pkg}-"; then
-        echo "  OK: $pkg"
-    else
-        echo "  MISSING: $pkg"
-        MISSING="$MISSING $pkg"
-    fi
-done
-if [ -n "$MISSING" ]; then
-    echo ""
-    echo "WARNING: missing packages:$MISSING"
-    echo "These will not be available in the ISO."
-fi
+echo "linux-headers installed: $(dpkg -l "linux-headers-${DEBIAN_KERNEL_ABI}-amd64" | awk '/^ii/{print $3}')"
 
 # --- Go toolchain ---
 echo ""
@@ -93,38 +69,6 @@ fi
 export PATH="$PATH:/usr/local/go/bin"
 echo "Go: $(go version)"
 
-# --- alpine-conf for mkimage ---
-apk add alpine-conf
-
-# --- aports for mkimage.sh ---
-if [ ! -d /usr/share/aports ]; then
-    echo ""
-    echo "=== cloning aports ==="
-    git clone --depth=1 --branch "v${ALPINE_VERSION:-3.21}.0" \
-        https://gitlab.alpinelinux.org/alpine/aports.git \
-        /usr/share/aports
-fi
-
-# --- abuild signing key (required by mkimage.sh) ---
-if [ ! -f "${HOME}/.abuild/abuild.conf" ]; then
-    echo ""
-    echo "=== generating abuild signing key ==="
-    mkdir -p "${HOME}/.abuild"
-    abuild-keygen -a -n 2>/dev/null || true
-    # abuild-keygen requires doas to install the key system-wide; do it manually
-    PUB=$(ls "${HOME}/.abuild/"*.pub 2>/dev/null | head -1)
-    if [ -n "$PUB" ]; then
-        cp "$PUB" /etc/apk/keys/
-        PRIV="${PUB%.pub}"
-        echo "PACKAGER_PRIVKEY=\"${PRIV}\"" > "${HOME}/.abuild/abuild.conf"
-        echo "abuild key: $PRIV"
-    else
-        echo "WARNING: abuild key generation failed"
-    fi
-fi
-
-# NOTE: lz4 compression for modloop is disabled — Alpine initramfs may not support lz4 squashfs.
-
 echo ""
 echo "=== builder setup complete ==="
-echo "Next: sh iso/builder/build-debug.sh"
+echo "Next: sh iso/builder/build.sh"