[fwiesel]

What this does

Moves the SCI virtualization stack out of the base image into seven
systemd-sysext extensions — EROFS-root GPT disk images with a signed
dm-verity pair — so each component owner ships and updates independently of
the base image, and a stock Garden Linux worker becomes a KVM hypervisor host
by merging extensions at runtime instead of re-imaging.

• build engine: every extension builds standalone on the pinned published
  base; builds are byte-reproducible and pinned three ways (apt suite, tools
  tree, resolved mkosi summary)
• delivery step: version-gated (TARGET_BASE), staged-raw integrity,
  idempotent reconcile, crash-safe activation, runs without privilege
• verity signing + boot test: every raw is signed; a three-scenario VM
  boot test proves the signed set boots and tampered/unsigned layers are
  refused
• CI: quick suite on every change, full suite plus hypervisor integration
  tests on push. Two outputs with different status: the sysext-raws
  artifact is a test artifact (the staging plus sci-delivery.sh, used by the
  integration job to rebuild the delivery image), and publish creates the
  product — a GitHub release tagged <Release>-g<short sha>
  (2150.9.0-g5556255 for this tip) that carries data only: seven raws, four
  activation shims, extensions.manifest, verity-run.crt, SHA256SUMS and
  SHA256SUMS.sig (15 files)
• fetch: a signed SHA256SUMS inventory verified against FETCH_PUBKEY,
  only changed files fetched, REMOVE= tombstones for dropped extensions, and
  a publish job that signs the release with
  SYSEXT_UNHARDENED_SIGNING_KEY; until that secret exists, the release steps
  skip with a notice and no release is created (the run-local CA stays inside
  the test run)
• design doc: docs/sysext-virt.md — every invariant, gotcha and open
  item; start there

The delivery contract in one paragraph

One manifest lists every extension in merge order; which extensions a
deployment runs is the consumer's choice (trim the manifest — the delivery
step never deploys a raw the manifest does not list). The release is the
product: a GitHub release tagged <Release>-g<short sha> (today
2150.9.0-g5556255) that carries data only — seven raws, four activation
shims, extensions.manifest, verity-run.crt, SHA256SUMS and
SHA256SUMS.sig, 15 files. publish removes sci-delivery.sh from the
upload directory before it regenerates the inventory, and a fail-closed
test ! -e guard stops the job if the file survives, so the signature covers
exactly the uploaded set. The sysext-raws artifact is the test vehicle, not
a second product: it still carries sci-delivery.sh because the integration
job rebuilds the delivery image from it.

• /etc carrier: the libvirt VNC port range (32200–32299) ships as a
  template in the qemu extension and is materialized by a tmpfiles C rule
  (copy-once) at activation, so no confext and no read-only /etc.
• Scope: the delivery step is the boot-test vehicle; the signed release
  is the product. A reuser owns selection, staging persistence, key and
  anchor provisioning, and the restart window. Fetch mode has no selection,
  and its convergence needs a persistent mounted staging directory.

Series (5 commits)

1. feat: sysext build engine, seven extensions, byte-reproducible builds
2. feat: sysext delivery step with version gate
3. feat: dm-verity signing and boot test
4. ci: prove the sysext artifacts on GitHub
5. docs: document the sysext build as it stands

Each commit is a self-contained layer: the quick suite passes at every
stop (7 → 69 → 103 → 140 → 140 items), and every message states what the
commit introduces and why, without narrating how it evolved.

Deliberately out of scope

• Production signing-key custody — the producer signs with
  SYSEXT_UNHARDENED_SIGNING_KEY when the repository secret exists and
  otherwise with a run-local CA (test-only by construction); publish signs
  the release only when the secret exists and skips with a notice otherwise.
  The private key never travels in an artifact. Key generation, storage and
  rotation are an open decision recorded in the doc.
• Landing on rel-2150-dev — needs a re-pin to the current 2150.x and a
  rebase; the branch pins 2150.9.0. This PR targets main for review.

Verification

extensions/tests/ — 152 items (140 quick, 11 build, 1 vm). The quick tier
runs on this PR; the push run builds all seven extensions, boot-tests the
merged system and runs the integration landscape on GitHub runners.

The full pipeline at 5556255 is green end to end:
quick suite (25 s), producer (full suite 152 passed in 251.60 s, VM boot
test, the one raws artifact), publish (10 s, all three release steps skipped
with the notice until the signing secret exists), and the integration
landscape (11m34 s) — consumer-side toolchain bootstrap and delivery rebuild
from the verified raws, sysext refresh, and the QEMU and Cloud-Hypervisor live
migrations, all verified on runner hardware (24.04, following the repo's
runner policy). The PR-event sysext run 41803253878 is green. The repo's
own dev workflow also runs on this branch: its PR path builds the legacy
flavors and then runs the legacy integration through this PR's modified
test.yml (run 41803254637; it was still in progress at the time of writing),
which is the backward-compatibility check for the sysext input gating.

Draft until: the deferred items above have owners (the green-run condition is
met).