OS deployment: image catalog with upstream sync, deploy/release jobs, agent deploy mode, UI and CLI

- rollcall os list|sync|import|promote|rm: <os_dir>/<name>/<version>/{disk.raw.zst,meta.json},
  current symlink, vendor checksum verification (GNU/BSD formats, sha256/sha512), qemu-img -> raw,
  zstd in-process, keep-N pruning, nightly rollcall-os-sync.timer, deploy/os-sources.json
  (Debian 13, Ubuntu 24.04, Rocky 9, AlmaLinux 9, CentOS Stream 9)
- jobs table + API: deploy (disk pick, hostname/IP allocation, job token, per-MAC deploy PXE
  entry), release (wipe), progress, cancel, cloud-init phone_home
- agent/rollcall-deploy.py: streamed write with sha256 + pv progress, NoCloud seed, SELinux
  autorelabel, efibootmgr on UEFI; commissioning image gains zstd/parted/xfsprogs/...
- web UI: deploy/release controls, deployment card with progress, OS catalog table
- README: deployment section, image freshness policy

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

deploy/config.example.json

@@ -12,6 +12,8 @@
   "images_dir": "/srv/rollcall/images",
   "overlays_dir": "/etc/rollcall/overlays",
   "dnsmasq_dir": "/var/lib/rollcall/dnsmasq",
+  "os_dir": "/srv/rollcall/os",
+  "os_sources": "/etc/rollcall/os-sources.json",
   "node_pools": {"mgmt": "10.213.77.50-10.213.77.99"},
   "cluster_vars": {
     "domain": "pxe.local",

deploy/install.sh

@@ -27,6 +27,11 @@ install -d /srv/rollcall/images
 install -d -m 0750 -o root -g rollcall /etc/rollcall/overlays
 cp -a overlays/. /etc/rollcall/overlays/
 chgrp -R rollcall /etc/rollcall/overlays
+# OS deployment images: <os_dir>/<name>/<version>/disk.raw.zst, written by `rollcall os sync` (user rollcall)
+install -d -m 0755 -o rollcall -g rollcall /srv/rollcall/os
+[ -e /etc/rollcall/os-sources.json ] || install -m 0644 os-sources.json /etc/rollcall/os-sources.json
+install -m 0644 rollcall-os-sync.service rollcall-os-sync.timer /etc/systemd/system/
+command -v qemu-img >/dev/null || echo "WARNING: qemu-img missing (apt install qemu-utils) - rollcall os sync/import will fail" >&2
 # dnsmasq host export + reload trigger
 install -d -m 0755 /var/lib/rollcall
 install -d -m 0755 -o rollcall -g rollcall /var/lib/rollcall/dnsmasq
@@ -36,6 +41,7 @@ install -m 0644 rollcall-controller-sync.service rollcall-controller-sync.timer
 install -m 0755 rollcall-controller-sync.sh /usr/local/bin/rollcall-controller-sync.sh
 systemctl daemon-reload
 systemctl enable --now rollcall-dnsmasq.path >/dev/null 2>&1 || true
+systemctl enable --now rollcall-os-sync.timer >/dev/null 2>&1 || true
 if systemctl list-unit-files slurmctld.service >/dev/null 2>&1 && [ -d /etc/slurm ]; then
   systemctl enable --now rollcall-controller-sync.timer >/dev/null 2>&1 || true
 fi

deploy/os-sources.json

@@ -0,0 +1,52 @@
+[
+  {
+    "name": "debian-13",
+    "description": "Debian 13 (trixie) generic cloud image",
+    "family": "debian",
+    "url": "https://cloud.debian.org/images/cloud/trixie/latest/debian-13-genericcloud-amd64.qcow2",
+    "checksum_url": "https://cloud.debian.org/images/cloud/trixie/latest/SHA512SUMS",
+    "checksum": "sha512",
+    "track": "latest",
+    "keep": 2
+  },
+  {
+    "name": "ubuntu-24.04",
+    "description": "Ubuntu 24.04 LTS (noble) server cloud image",
+    "family": "debian",
+    "url": "https://cloud-images.ubuntu.com/noble/current/noble-server-cloudimg-amd64.img",
+    "checksum_url": "https://cloud-images.ubuntu.com/noble/current/SHA256SUMS",
+    "checksum": "sha256",
+    "track": "latest",
+    "keep": 2
+  },
+  {
+    "name": "rocky-9",
+    "description": "Rocky Linux 9 GenericCloud (Base)",
+    "family": "rhel",
+    "url": "https://dl.rockylinux.org/pub/rocky/9/images/x86_64/Rocky-9-GenericCloud-Base.latest.x86_64.qcow2",
+    "checksum_url": "https://dl.rockylinux.org/pub/rocky/9/images/x86_64/CHECKSUM",
+    "checksum": "sha256",
+    "track": "latest",
+    "keep": 2
+  },
+  {
+    "name": "almalinux-9",
+    "description": "AlmaLinux 9 GenericCloud",
+    "family": "rhel",
+    "url": "https://repo.almalinux.org/almalinux/9/cloud/x86_64/images/AlmaLinux-9-GenericCloud-latest.x86_64.qcow2",
+    "checksum_url": "https://repo.almalinux.org/almalinux/9/cloud/x86_64/images/CHECKSUM",
+    "checksum": "sha256",
+    "track": "latest",
+    "keep": 2
+  },
+  {
+    "name": "centos-stream-9",
+    "description": "CentOS Stream 9 GenericCloud",
+    "family": "rhel",
+    "url": "https://cloud.centos.org/centos/9-stream/x86_64/images/CentOS-Stream-GenericCloud-x86_64-9-latest.x86_64.qcow2",
+    "checksum_url": "https://cloud.centos.org/centos/9-stream/x86_64/images/CentOS-Stream-GenericCloud-x86_64-9-latest.x86_64.qcow2.SHA256SUM",
+    "checksum": "sha256",
+    "track": "latest",
+    "keep": 2
+  }
+]

deploy/rollcall-os-sync.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=rollcall: refresh OS deployment images from upstream (downloads only when the vendor checksum changed)
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+User=rollcall
+Group=rollcall
+ExecStart=/usr/local/bin/rollcall os sync
+Nice=10
+IOSchedulingClass=idle
+TimeoutStartSec=6h

deploy/rollcall-os-sync.timer

@@ -0,0 +1,10 @@
+[Unit]
+Description=rollcall: nightly OS image refresh
+
+[Timer]
+OnCalendar=*-*-* 03:30:00
+RandomizedDelaySec=30m
+Persistent=true
+
+[Install]
+WantedBy=timers.target