Wire up arm64 without claiming it works

Proxmox VE 9.2 made arm64 official — same code base, repositories and release
lifecycle as x86-64 — and the pve-no-subscription repository carries proxmox-ve,
pve-manager, proxmox-default-kernel and pve-qemu-kvm for it. The build was still
hard-wired to amd64 in four places, which is now fixed:

  * firmware is chosen from the target architecture (AAVMF for arm64, OVMF for
    amd64) and padded to 64 MiB as QEMU's arm64 virt machine requires. Upstream
    packer-maas keys this on the host architecture, which only works when host
    and target match.
  * host_is_arm is derived from uname rather than hard-coded false, so KVM is
    used exactly when host and target architectures agree
  * the release body builds its MAAS upload command from MAAS_ARCH, PVE_VERSION
    and IMAGE_NAME instead of repeating amd64
  * install-deps.sh installs qemu-system-arm and AAVMF under WITH_ARM64=1,
    off by default since they are useless on an amd64-only builder

verify-image.sh asserted no kernel matching *-amd64, which would have passed
silently on an arm64 image carrying a Debian arm64 kernel. It now rejects any
/boot/vmlinuz-* not ending in -pve, which holds for both architectures. Checking
that with synthetic file lists caught a first attempt that returned "pass" for an
image containing both a PVE and a Debian kernel, so the expression is now a single
pipeline verified against GNU grep on the build host — the macOS grep this was
first tried on disagrees, and only the Linux behaviour matters here.

No arm64 image has been built and none deployed. The README gains an arm64
section saying so plainly, listing the two real obstacles — TCG emulation on an
x86_64 builder, and having no arm64 hardware to deploy to — and the entry stays
under "Not verified".

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Makefile

@@ -31,6 +31,9 @@ PVE_EXTRA_PACKAGES ?= ifupdown2 open-iscsi chrony postfix lvm2 thin-provisioning
                       ethtool bridge-utils ipmitool nvme-cli lsscsi sudo
 
 # ---------------------------------------------------------------- imaj ayarlari
+# amd64 | arm64.  arm64 is wired up but has never been built or deployed -
+# see "Verified status" in the README.  Building arm64 on an x86_64 host means
+# TCG emulation with no KVM, which is very slow; prefer a native arm64 builder.
 ARCH             ?= amd64
 SUBARCH          ?= generic
 BOOT             ?= uefi
@@ -85,8 +88,21 @@ MAAS_IMAGE_NAME  ?= custom/$(IMAGE_NAME)
 # MAAS snap kurulumu icin: /var/snap/maas/current/preseeds
 MAAS_PRESEED_DIR ?= /var/snap/maas/current/preseeds
 
-OVMF_DIR         ?= /usr/share/OVMF
-OVMF_SFX         ?= $(shell test -f $(OVMF_DIR)/OVMF_CODE.fd && echo "" || echo "_4M")
+# UEFI firmware, keyed on the TARGET architecture - an aarch64 guest needs
+# AAVMF whatever the build host is. (Upstream packer-maas keys this on the host
+# architecture instead, which only works when host and target match.)
+ifeq ($(strip $(ARCH)),arm64)
+FW_DIR           ?= /usr/share/AAVMF
+FW               ?= AAVMF
+else
+FW_DIR           ?= /usr/share/OVMF
+FW               ?= OVMF
+endif
+FW_SFX           ?= $(shell test -f $(FW_DIR)/$(FW)_CODE.fd && echo "" || echo "_4M")
+
+# KVM is only usable when the host and the guest share an architecture.
+# Otherwise QEMU falls back to TCG emulation, which is very slow.
+HOST_IS_ARM      := $(shell test "$$(uname -m)" = aarch64 && echo true || echo false)
 
 # ---------------------------------------------------------------- hedefler
 .PHONY: help deps deps-cache check-upstream print-var checkout overlay customize image verify preseed install-preseed upload clean distclean lint
@@ -165,8 +181,13 @@ ifeq ($(strip $(DEBIAN_IMAGE_CHANNEL)),stable)
 endif
 	sed -i -E 's|--best --force|-$(GZIP_LEVEL) --force|' $(PM)/scripts/fuse-tar-root
 	@grep -nE 'disk_size|^  cpus|^  memory' $(TPL)/debian-cloudimg.pkr.hcl
-	cp -v $(OVMF_DIR)/OVMF_CODE$(OVMF_SFX).fd $(TPL)/OVMF_CODE.fd
-	cp -v $(OVMF_DIR)/OVMF_VARS$(OVMF_SFX).fd $(TPL)/OVMF_VARS.fd
+	cp -v $(FW_DIR)/$(FW)_CODE$(FW_SFX).fd $(TPL)/OVMF_CODE.fd
+	cp -v $(FW_DIR)/$(FW)_VARS$(FW_SFX).fd $(TPL)/OVMF_VARS.fd
+ifeq ($(strip $(ARCH)),arm64)
+	# AAVMF images must be padded to 64 MiB for QEMU's arm64 "virt" machine.
+	truncate -s 64m $(TPL)/OVMF_CODE.fd
+	truncate -s 64m $(TPL)/OVMF_VARS.fd
+endif
 	rm -rf $(TPL)/output-cloudimg $(TPL)/seeds-cloudimg.iso
 	cd $(TPL) && PACKER_LOG=$(PACKER_LOG) packer init .
 	cd $(TPL) && PACKER_LOG=$(PACKER_LOG) packer build \
@@ -174,8 +195,8 @@ endif
 	    -var debian_version=$(DEBIAN_VERSION) \
 	    -var architecture=$(ARCH) \
 	    -var boot_mode=$(BOOT) \
-	    -var ovmf_suffix=$(OVMF_SFX) \
-	    -var host_is_arm=false \
+	    -var ovmf_suffix=$(FW_SFX) \
+	    -var host_is_arm=$(HOST_IS_ARM) \
 	    -var timeout=$(TIMEOUT) \
 	    -var customize_script=$(CUSTOMIZE) \
 	    -var filename=$(OUTPUT) \