build/rfs: integrate RFS flists + runtime orchestration

• Add standalone RFS tooling: scripts/rfs/common.sh, pack-modules.sh, pack-firmware.sh, verify-flist.sh

• Patch flist route.url with read-only Garage S3 credentials; optional HTTPS store row; optional manifest upload via mcli

• Build integration: stage_rfs_flists in scripts/build.sh to pack and embed manifests under initramfs/etc/rfs

• Runtime: add zinit units rfs-modules (after: network), rfs-firmware (after: network) as daemons; add udev-rfs oneshot post-mount

• Keep early udev-trigger oneshot to coldplug NICs before RFS mounts

• Firmware flist reproducible naming: respect FIRMWARE_TAG from env or config/build.conf, default to latest

• Docs: update docs/rfs-flists.md with runtime ordering, reproducible tagging, verification steps

config/build.conf

@@ -34,6 +34,15 @@ DIST_DIR="dist"
 ALPINE_MIRROR="https://dl-cdn.alpinelinux.org/alpine"
 KERNEL_SOURCE_URL="https://cdn.kernel.org/pub/linux/kernel"
 
+# RFS flists (firmware manifest naming)
+# FIRMWARE_TAG controls firmware flist manifest naming for reproducible builds.
+# - If set, firmware manifest becomes: firmware-$FIRMWARE_TAG.fl
+# - If unset, the build embeds firmware-latest.fl, while standalone pack may default to date-based naming.
+# Examples:
+# FIRMWARE_TAG="20250908"
+# FIRMWARE_TAG="v1"
+#FIRMWARE_TAG="latest"
+
 # Feature flags
 ENABLE_STRIP="true"
 ENABLE_UPX="true"

config/zinit/rfs-firmware.yaml

@@ -0,0 +1,4 @@
+exec: sh /etc/zinit/init/firmware.sh
+restart: always
+after:
+  - network

config/zinit/rfs-modules.yaml

@@ -0,0 +1,4 @@
+exec: sh /etc/zinit/init/modules.sh
+restart: always
+after:
+  - network

config/zinit/udev-rfs.yaml

@@ -0,0 +1,5 @@
+exec: /bin/sh -c "udevadm control --reload; udevadm trigger --action=add --type=subsystems; udevadm trigger --action=add --type=devices; udevadm settle"
+oneshot: true
+after:
+  - rfs-modules
+  - rfs-firmware