…tats)

#1 Orphaned 37-ollama-prep.sh -- replaced with first-boot service
   Build-time embedding never worked: the OCI build's final /var
   cleanup wipes /var/lib/ollama before commit, so models pulled
   in 37-ollama-prep.sh got deleted before they could ship. Drop
   the script to a no-op stub, document the migration, and wire
   the work to a runtime service that runs once per deploy:
     usr/lib/systemd/system/mios-ollama-firstboot.service
     usr/libexec/mios/ollama-firstboot.sh
   The service waits for the mios-ollama Quadlet, then runs
   'podman exec mios-ollama ollama pull' for qwen2.5-coder:7b and
   nomic-embed-text. Sentinel /var/lib/mios/.ollama-firstboot-done
   guards re-runs. Enabled via 90-mios.preset.

#2 ceph-bootstrap.sh path mismatch -- create script + fix paths
   Both ceph-bootstrap.service and mios-ceph-bootstrap.service
   ExecStart'd /usr/local/bin/ceph-bootstrap.sh, but no such file
   existed in the repo and 13-ceph-k3s.sh only chmod'd a phantom
   path. /usr/local resolves to /var/usrlocal on bootc/FCOS and
   gets wiped by /var cleanup anyway. Create the script at
   /usr/libexec/mios/ceph-bootstrap.sh (immutable image surface)
   with a real cephadm bootstrap implementation
   (--single-host-defaults --skip-monitoring-stack), and update
   both unit files + 13-ceph-k3s.sh to point at the new path.

#3 /var build-time write removed (Architectural Law 2)
   automation/31-user.sh:50 used to 'cp -a /etc/skel/. "$home/"'
   into /var/home at build time. The Containerfile's final /var
   cleanup wiped that work, then the deployed image had no skel-
   seeded home. Drop the build-time copy; rely on the existing
   first-boot paths (wsl-firstboot for WSL2, role-apply for bootc)
   which run after /var is mounted persistent.

#4a python3-requests added to PACKAGES.md
   /usr/bin/mios (Python CLI) imports requests; without the rpm
   the import failed at runtime and pip can't recover on the
   read-only /usr composefs surface.

#4b userenv.sh deployed to /usr/lib/mios/userenv.sh
   /usr/bin/mios-env (Architectural Law 5 resolver) sources
   /usr/lib/mios/userenv.sh, but the file lived only at
   tools/lib/userenv.sh in the build context with no install
   step. mios-env therefore fell back to env-defaults-only and
   ignored the three-layer mios.toml overlay. 36-tools.sh now
   stages the file with 'install -D -m 0644'.

#5 SELinux container_use_devices already addressed
   Earlier commit 7b56947 wrote
   /usr/share/selinux/packages/mios/booleans.conf at build time
   in 37-selinux.sh, and selinux-init.service applies it on
   first boot via 'setsebool -P'. Verified the runtime path is
   wired -- no further change needed.

#6 log-to-bootstrap.sh stats now computed dynamically
   Previously hard-coded 928 MB / 153 markdown / 116 shell
   scripts in both manifest.json and the README. Replace with
   du -sb on the working tree (excluding .git), 'find ... -name
   *.md / *.sh | wc -l', and a bc-driven compression ratio. The
   'compressed_context_size' picks the newest *.tar.gz under
   artifacts/ai-rag rather than naming a specific bundle.