Merge nucleic/olive-ember-seal-q7vk into dev

packages/nash/control

@@ -0,0 +1,12 @@
+Package: nash
+Version: @VERSION@
+Architecture: @ARCH@
+Maintainer: Nucleic <[email protected]>
+Section: shells
+Priority: optional
+Description: Nucleic agent shell (brush fork)
+ Bourne/bash-compatible shell whose job is to make every shell action an agent
+ takes observable by construction (docs/NASH.md). Static musl binary; installs
+ as /usr/bin/nash with the locked /usr/local/bin/nash path provided as a
+ symlink. This package does NOT change the default shell — that is
+ nash-default-shell's job.

packages/nash/postinst

@@ -0,0 +1,9 @@
+#!/bin/sh
+# The locked contract (NASH.md §2, §7) addresses nash at /usr/local/bin/nash on every
+# surface (probe, exec argv, $SHELL). The real file lives at /usr/bin/nash per policy;
+# this symlink satisfies the contract path.
+set -e
+if [ "$1" = "configure" ]; then
+    mkdir -p /usr/local/bin
+    ln -sf /usr/bin/nash /usr/local/bin/nash
+fi

packages/nash/prerm

@@ -0,0 +1,5 @@
+#!/bin/sh
+set -e
+if [ "$1" = "remove" ]; then
+    [ -L /usr/local/bin/nash ] && rm -f /usr/local/bin/nash || true
+fi

packages/nash/stage.sh

@@ -0,0 +1,9 @@
+# Stage the prebuilt static nash binary (built by CI from shell/, target musl).
+stage() {
+  local dest="$1" arch="$2" bin="$OS_DIR/dist/bin/nash-$arch"
+  if [ ! -x "$bin" ]; then
+    echo "prebuilt binary missing: $bin" > "$dest/.skip-reason"
+    return 1
+  fi
+  install -D -m 0755 "$bin" "$dest/usr/bin/nash"
+}