Merge nucleic/olive-ember-seal-q7vk into dev

mkimage/profiles/agent.pkgs

@@ -0,0 +1,3 @@
+# naros-agent tier (NAROS.md §4, milestone N2 — placeholder until the agent tier lands).
+# Will carry: build-essential/pkg-config, python3 + pip/venv, the modern CLI kit, and the
+# hooks that add Node (NodeSource), rustup, Go, mise, warm caches, agent CLIs, Playwright.

mkimage/profiles/base.late-pkgs

@@ -0,0 +1,5 @@
+# Installed via dpkg -i in a finish hook, after every Debian package is configured.
+# nash-default-shell MUST be last-stage: its divert flips /bin/sh to nash, and any
+# Debian postinst that runs after the flip runs under nash (see build-rootfs.sh).
+nash-default-shell
+naros-tier-base

mkimage/profiles/base.naros-pkgs

@@ -0,0 +1,7 @@
+# Nucleic packages for naros-base, resolved from the local pool when --pool is given.
+# The divert package + tier meta are in base.late-pkgs (must configure last); this list
+# is what installs alongside the Debian set.
+nash
+naros-init
+naros
+naros-keyring

mkimage/profiles/base.pkgs

@@ -0,0 +1,7 @@
+# naros-base Debian package list (NAROS.md §4). Kept deliberately small — the agent
+# toolchain lives in the agent tier. apt itself comes from --variant=apt.
+ca-certificates
+curl
+git
+openssh-client
+iproute2