Stage 6: server image with a console installer (0.4.0)

- server/ profile and build-iso.sh [desktop|server]; make iso-server,
  make qemu-server, run-qemu.sh --serial; login on tty and ttyS0
- das-server: SSH, chrony, NetworkManager/dhcpcd, Docker with Compose,
  nftables (closed except SSH, own table), fail2ban reading socklog,
  sshd without root passwords, Docker log rotation, tools
- das-server-install: dialog installer in Ukrainian and English, or
  unattended with --config; GPT + Btrfs subvolumes, GRUB for UEFI and BIOS,
  serial console, SSH key with optional keys-only logins
- das-install-common: mount-source and postinstall shared with Calamares
- dsv: runit service manager (list, enable, disable, start, stop,
  restart, status, logs) with bash completion, also on the desktop
- das-update split into a subpackage without GTK; the window and tray
  icon move to /usr/libexec/das/das-update-gui
- das-snapper-setup enables dbus, which snapper needs
- TODO: ISO size review with measured numbers and options

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

srcpkgs/das-install-common/files/postinstall

@@ -0,0 +1,71 @@
+#!/bin/sh
+# Finish a Das OS installation. The installers (Calamares, das-server-install)
+# run this inside the target system after users and locale are configured,
+# before GRUB.
+set -eu
+
+msg() { echo "das-postinstall: $*"; }
+
+# Calamares writes LANG to /etc/locale.conf, but glibc on Void only builds the
+# locales enabled in /etc/default/libc-locales.
+lang=$(sed -n 's/^LANG=//p' /etc/locale.conf 2>/dev/null | tr -d '"')
+for l in "$lang" en_US.UTF-8; do
+	[ -n "$l" ] || continue
+	re=$(printf '%s' "$l" | sed 's/[.]/\\./g')
+	sed -i "s/^#\(${re} \)/\1/" /etc/default/libc-locales
+done
+msg "building locales"
+xbps-reconfigure -f glibc-locales
+
+# Calamares mounts /tmp on tmpfs only when the root disk is an SSD; Void's own
+# installer always does.
+if ! grep -q '^[^#]*[[:space:]]/tmp[[:space:]]' /etc/fstab; then
+	echo "tmpfs /tmp tmpfs defaults,nosuid,nodev 0 0" >>/etc/fstab
+fi
+
+# Guest tools only help inside their own hypervisor (VirtualBox's ones even
+# complain at every login elsewhere).
+machine=$(cat /sys/class/dmi/id/sys_vendor /sys/class/dmi/id/product_name 2>/dev/null || true)
+if ! grep -q '^flags.* hypervisor' /proc/cpuinfo; then
+	machine="real hardware"
+fi
+case $machine in
+*VirtualBox* | *innotek*) unused="spice-vdagent qemu-ga" ;;
+*QEMU* | *KVM*) unused="virtualbox-ose-guest" ;;
+*) unused="spice-vdagent qemu-ga virtualbox-ose-guest" ;;
+esac
+installed=""
+for pkg in $unused; do
+	xbps-query "$pkg" >/dev/null 2>&1 && installed="$installed $pkg"
+done
+case $installed in
+*spice-vdagent*) rm -f /etc/runit/runsvdir/default/spice-vdagentd ;;
+esac
+case $installed in
+# The live image replaces this autostart file, so xbps keeps it as modified
+*virtualbox*) rm -f /etc/xdg/autostart/vboxclient.desktop ;;
+esac
+if [ -n "$installed" ]; then
+	msg "removing guest tools not needed here:$installed"
+	# shellcheck disable=SC2086
+	xbps-remove -Ry $installed || true
+fi
+
+# Snapper, hourly snapshots and the GRUB snapshot menu (Btrfs only).
+das-snapper-setup
+
+# The installer copies files with rsync --sparse, which turns the zero tail of
+# a kernel image into a Btrfs hole that GRUB 2.12 can't read ("premature end
+# of file"). Rewrite the kernels in full.
+for f in /boot/vmlinuz-*; do
+	cp --sparse=never "$f" "$f.das-tmp"
+	mv "$f.das-tmp" "$f"
+done
+
+# The live image has a generic initramfs. Build the target's own the same way
+# Void does on kernel updates (host-only), with das-snapshot-overlay included.
+msg "building the initramfs"
+for kver in $(ls /usr/lib/modules); do
+	dracut -q --force "/boot/initramfs-$kver.img" "$kver"
+done
+msg "done"