fix(image): preserve installer kernel and verified update contracts

image/README.md

@@ -8,6 +8,8 @@ scripts/hydra-build fetch
 scripts/hydra-build prepare
 scripts/hydra-build packages --pretend
 scripts/hydra-build packages
+scripts/hydra-build rootfs
+scripts/hydra-build iso
 scripts/hydra-build status
 ```
 
@@ -34,5 +36,12 @@ for installed-system updates. Rolling binhost contents can change; resulting
 versions/USE are recorded without claiming bit-identical output. The pinned
 service-keyring hash may need deliberate review when Gentoo rotates keys.
 
-`rootfs` and `iso` are reserved assembly commands and currently return an
-explicit error until the live-image assembly implementation is integrated.
+`rootfs` exports the dedicated builder into a private intermediate and assembles
+an isolated sanitized payload, generic live initramfs and squashfs. `iso` checks
+those artifacts and emits the UEFI `HYDRA_OS` ISO, SHA256 and build manifest in
+`build/artifacts/`. The working builder is retained for package retries. The
+installed Gentoo repository uses the standard rsync backend with signed
+metamanifest verification; the builder continues to use its pinned snapshot.
+QEMU and remote-viewer retain local patches and are excluded from upstream
+binary packages on installed updates. Disposable boot/install validation is
+required before treating an emitted ISO as release ready.

image/configure-rootfs.sh

@@ -6,6 +6,11 @@ if [[ $# != 1 || "$1" != /hydra-output/rootfs ]]; then
 fi
 root=$1
 python3 /hydra-source/hydra/image.py configure "$root" --source /hydra-source
+# This is a separate rootfs inside the assembly container, never the host root.
+mount --bind /dev "$root/dev"
+mount -t proc proc "$root/proc"
+mount --bind /sys "$root/sys"
+trap 'umount "$root/sys" "$root/proc" "$root/dev"' EXIT
 for group in wheel kvm video render audio; do
     chroot "$root" getent group "$group" >/dev/null || chroot "$root" groupadd -r "$group"
 done
@@ -24,10 +29,5 @@ chroot "$root" chmod 0750 /usr/libexec/qemu-bridge-helper
 chroot "$root" visudo --check
 systemctl --root="$root" enable NetworkManager.service greetd.service hydra-network.service hydra-dnsmasq.service hydra-bridge-permissions.service getty@tty2.service serial-getty@ttyS0.service
 systemctl --root="$root" set-default graphical.target
-# This is a separate rootfs inside the assembly container, never the host root.
-mount --bind /dev "$root/dev"
-mount -t proc proc "$root/proc"
-mount --bind /sys "$root/sys"
-trap 'umount "$root/sys" "$root/proc" "$root/dev"' EXIT
 kernel=$(python3 /hydra-source/hydra/image.py kernel "$root")
 chroot "$root" dracut --force --no-hostonly --no-hostonly-cmdline --conf /etc/hydra/live-mode/dracut.conf --confdir /etc/hydra/live-mode/dracut.conf.d --add dmsquash-live /boot/initramfs-live.img "$kernel"

image/rootfs/etc/portage/repos.conf/gentoo.conf

@@ -0,0 +1,11 @@
+[gentoo]
+location = /var/db/repos/gentoo
+sync-type = rsync
+sync-uri = rsync://rsync.gentoo.org/gentoo-portage
+auto-sync = yes
+sync-rsync-verify-metamanifest = yes
+sync-rsync-verify-max-age = 3
+sync-openpgp-key-package = sec-keys/openpgp-keys-gentoo-release
+sync-openpgp-key-path = /usr/share/openpgp-keys/gentoo-release.asc
+sync-openpgp-keyserver = hkps://keys.gentoo.org
+sync-webrsync-verify-signature = yes