Merge nucleic/eager-ancient-heron-p5em into dev

README.md

@@ -26,6 +26,12 @@ packages/
 repo/
   publish.sh             # dist/pool → apt tree (dists/<channel>/…), signs when a key is present
   r2-sync.sh             # pushes the apt tree to Cloudflare R2 (CI; needs credentials)
+images/
+  agent/                 # naros-agent OCI layer FROM naros-base (Dockerfile + build.sh):
+                         #   naros-tier-agent (apt), Node 22, rustup, Go, mise, warm
+                         #   caches, agent user (uid 501), agent CLIs, Playwright
+tests/
+  parity-sweep.sh        # tool-inventory diff vs the previous default sandbox image
 dist/                    # build output (gitignored): bin/, pool/, repo/, rootfs tars
 ```
 
@@ -55,6 +61,15 @@ docker run --rm naros-base:test sh -c '. /etc/os-release && echo "$ID $VERSION_I
 Without `--pool`, the build produces a plain identity-only base (no Nucleic packages) —
 useful for validating the mmdebstrap/snapshot/identity plumbing in isolation.
 
+Agent tier (needs docker; the agent tier is an OCI **layer** on naros-base, not a
+separate mmdebstrap run, so pulls dedupe on the shared base):
+
+```sh
+docker import os/dist/naros-base-<ver>-arm64.tar naros-base:local
+os/images/agent/build.sh arm64 --base naros-base:local
+docker run --rm naros-agent:build-arm64 nash -lc 'naros info'
+```
+
 ## Versioning
 
 `VERSION` + `SNAPSHOT` define a release (NAROS.md §8). Channels: `edge` (weekly CI,