feat(images): add Debian testing, Fedora Rawhide and Ubuntu 24.04 machine images

[bketelsen]

Summary

Adds three machine images, each as a new profile of an existing family:

Selector(s)	Profile	Family	systemd	Size (zstd)
debian:testing	debian-testing	debian	262-1 (forky)	119 MB
fedora:rawhide	fedora-rawhide	rpm	262-3.fc46	121 MB
ubuntu:noble, ubuntu:24.04	ubuntu-noble	debian	255.4	96 MB

• Debian testing uses release testing, so the image's apt sources keep a machine on testing after forky ships. Its os-release has no VERSION_ID, so os_version is rolling, the same as Arch.
• Fedora Rawhide sets RepositoryKeyFetch=yes, so mkosi fetches Rawhide's current signing key. That key moves at each branch point.
• Ubuntu 24.04 uses the Fedora 44 tools tree for the Ubuntu keyring, the same as 26.04. Its systemd 255 is older than the VM's 257 and still passes.
• The existing profiles stay each distribution's default when build-image.sh gets no --release. A new test pins this.

Fix found by acceptance: mount in the Debian family

Debian's systemd 262 lists mount under Recommends rather than Depends, and mkosi doesn't install Recommends. The first Debian testing image therefore had no mount(8), and every mount unit failed. That included run-nsl-proc.mount, which broke rootless Podman. The debian family now names mount. Debian 13 and Ubuntu 26.04 already got it through systemd, so their content is unchanged, but their inputs changed, so they move to r6 and r3.

Policy

ADR-0009 now admits development branches on the same terms as betas, and the docs label them as such. Publication is all-or-nothing, so a broken Rawhide or testing week holds back the whole catalogue until its profile is fixed. The publication design notes this, and operation=refresh covers the gap. If it happens often, the plan's Later section proposes carrying the last accepted image forward.

Evidence

Everything is in docs/plans/more-releases.md. All runs used VM image r10 (511a0431…) with probe-machines.py --gui --isolated:

• Run 1: Rawhide r1 and Ubuntu 24.04 r1 passed every check, including the isolated Ubuntu machine. Debian testing r1 failed system, tally, podman and persistence because mount was missing.
• Run 2: Debian testing r2, Rawhide r1, Ubuntu 24.04 r2 and Ubuntu 26.04 r3 passed all 12 checks each, and the isolated Debian testing machine passed all 8. Debian 13 r6 failed packages on a deb.debian.org hash mismatch, and five other checks failed because they need those packages.
• Run 3, minutes later: Debian 13 r6 and Ubuntu 26.04 r3 passed all 12 checks each.
• Memory was not measured. The gate's images are unchanged in content and size, and the publication run measures again.

make ci and make site pass.

After merge

Phase 2: dispatch images.yml from main, then check nsl create with each new selector on a host with an empty cache. No CLI release is needed.

🤖 Generated with Claude Code