Merge nucleic/lucid-lunar-wren-wxyw into dev

packages/nucleic-a11y-agent/control

@@ -0,0 +1,13 @@
+Package: nucleic-a11y-agent
+Version: @VERSION@
+Architecture: @ARCH@
+Maintainer: Nucleic <[email protected]>
+Section: admin
+Priority: optional
+Depends: at-spi2-core
+Description: Nucleic Linux guest AT-SPI semantic agent (NAROS.md §7.4 N5; LINUX_VM_SEMANTIC_AGENT.md)
+ The Rust (zbus/tokio) accessibility agent — the ax_* semantic control plane over
+ AF_VSOCK port 2036. A systemd USER service inside the graphical session so it can
+ reach that session's AT-SPI a11y bus. Baked into the naros-vm desktop flavor
+ (pulled by naros-tier-vm-desktop); complements the static-C nucleic-linux-agent
+ (exec, port 2035). Absent → the host falls back to screenshot + pixel actions.

packages/nucleic-a11y-agent/stage.sh

@@ -0,0 +1,21 @@
+# Stage the prebuilt Rust AT-SPI semantic agent + its systemd USER unit, with a static
+# global-enable symlink so it starts in every graphical session (no `systemctl --global
+# enable` needed inside the mmdebstrap chroot). Prefer the CI-built dist/bin binary; fall
+# back to the committed guest build (arm64) — the same artifact the pre-narOS base build bakes.
+stage() {
+  local dest="$1" arch="$2"
+  local bin="$OS_DIR/dist/bin/nucleic-a11y-agent-$arch"
+  if [ ! -x "$bin" ] && [ "$arch" = arm64 ]; then
+    bin="$OS_DIR/../guest/nucleic-a11y-agent/build/nucleic-a11y-agent"
+  fi
+  local unit="$OS_DIR/../guest/nucleic-a11y-agent/systemd/nucleic-a11y-agent.service"
+  if [ ! -x "$bin" ]; then
+    echo "prebuilt binary missing: dist/bin/nucleic-a11y-agent-$arch" > "$dest/.skip-reason"
+    return 1
+  fi
+  install -D -m 0755 "$bin" "$dest/usr/local/bin/nucleic-a11y-agent"
+  install -D -m 0644 "$unit" "$dest/usr/lib/systemd/user/nucleic-a11y-agent.service"
+  install -d "$dest/etc/systemd/user/graphical-session.target.wants"
+  ln -sf /usr/lib/systemd/user/nucleic-a11y-agent.service \
+    "$dest/etc/systemd/user/graphical-session.target.wants/nucleic-a11y-agent.service"
+}