System installer: multi-distro vds_hcd setup

[LordVicky]

Implements docs/superpowers/specs/2026-07-11-system-installer-design.md.

What

• installer/opends5-install: interactive installer that detects distro/kernel flavor/immutability/Secure Boot state, prints a plan, and executes it with per-step pkexec/sudo escalation.
• Platforms: Fedora (dnf, CachyOS COPR kernels), Arch/CachyOS (flavor-matched headers, LLVM=1 on Clang/LTO kernels), Debian/Ubuntu, openSUSE, Bazzite/Silverblue (rpm-ostree akmods layering), NixOS (generates opends5-vds.nix, no imperative changes), clean refusal otherwise.
• Secure Boot: DKMS signing key at /var/lib/opends5/; MOK enrollment only when the kernel actually enforces signatures (lockdown or MODULE_SIG_FORCE) — not merely when SB is on.
• Fail-closed: first failing step aborts, prints manual retry, rolls back DKMS registration (exit 4).
• Wire-up: OpenDS5.AppImage --install-system runs the bundled installer (module source bundled via extraResources; app version passed as module version); install-system.sh now delegates its kernel-module section to the installer.
• Docs: docs/INSTALLER.md + README section.

Tests

• installer/tests/run-tests.sh: 57 fixture-based tests (detection, per-distro dry-run plans, Secure Boot logic, execution/rollback via stubbed root helper, NixOS generation) — all green, no root needed.
• Companion vitest: 402 passed; typecheck clean.

Dry-run on the dev box (Fedora + CachyOS COPR kernel, SB on, lockdown none)

1. Install DKMS and kernel headers (dnf)        # dnf install -y dkms kernel-cachyos-devel
2. Configure DKMS module signing                # key at /var/lib/opends5/mok.key
3. Stage module source to /usr/src/vds_hcd-<ver>
4. Register and build vds_hcd with DKMS
5. Enable autoload on boot
(no mokutil --import — enforcement off, correct)

Hardware validation still needed

Run bash installer/opends5-install for real on the dev box before merge (should be an idempotent reinstall).

🤖 Generated with Claude Code