feat(schemas): default Talos image build output and tighten dir constraint

[jmgilman]

Summary

Shrink the minimum valid Talos image build config so authors can omit the entire output: block when lab defaults are appropriate, and bring output.dir into the same #RelativePath constraint already applied to file inputs. The minimal example in the schema README drops to four fields; everything else defaults.

This is PR 3 of 5 from the session 057 plan. Independent of PR 1 (#65) and PR 2 (#66) — different files entirely. Triggers a schemas/lab release cycle.

What changed

• output.dir defaults to .state/images and is now #RelativePath. Absolute paths and .. segments are rejected at validation time, matching userData.path.
• output.bootArtifactName defaults to talos-boot.img.
• output.configArtifactName defaults to talos-cidata.img.
• output itself is now optional on #ImageBuild because every nested field has a default. The minimal example in schemas/lab/talos/README.md drops to name + source.version + config.userData.path + config.metaData.localHostname.

The generated Go types lose their NonEmptyString / ArtifactName named-string constraints because CUE renders *default | type disjunctions as the underlying Go string. The cast removals in tools/labctl/internal/app/talosimage/service.go follow from that — the validator still enforces the constraints at YAML parse time, the Go type system just no longer carries them.

Why now

Session 057's review flagged that the existing output.dir was looser (#NonEmptyString) than the analogous #FileInput.path (#RelativePath), and that several output fields were required when they had stable, unsurprising defaults. Authors can now write a four-field config to build a default lab image.

Out of scope

• HTTP/download reliability (PR 1 feat(labctl): harden Talos image build reliability #65).
• Cidata permission / dynamic size (PR 2 feat(labctl): protect Talos cidata as secret material and size dynamically #66).
• Progress reporting (PR 4).
• Declarative extensions (PR 5).
• Talos machine-config generation from patches + secrets bundle (deferred).

Release machinery

After merge, Release Please will open a chore(master): release schemas/lab X.Y.Z PR. Following session 056's pattern: merge that, then manually publish the CUE module (cue mod publish) until the Publish Lab Schemas workflow's GHCR auth is fixed, then bump labctl's go.mod if needed in a follow-up. Local labctl tests pass via go.work resolving to the local schemas dir, so master CI stays green during the release cycle.

Test plan

• go test ./... from tools/labctl/ and schemas/lab/ — full suites pass.
• moon run schemas:check labctl:check --summary minimal — all green.
• moon ci --summary minimal from platform/ — all 14 actions pass.
• New unit test (talosconfig.TestValidateYAMLAppliesOutputDefaults) confirms the four defaults render when output: is omitted.
• New txtar case talos-minimal.yaml confirms a config with no output: block produces artifacts at .state/images/talos-boot.img and .state/images/talos-cidata.img.
• Existing parent-path test (#FileInput.path) continues to enforce #RelativePath rejection — covers the same constraint type now applied to output.dir.

🤖 Generated with Claude Code