v2026.281.1251

fix(vm): pin the Arch cloud image to a release the mirror serves (#849)

Six entities pinned v20260701.551070 — a release the mirror has pruned from its rolling
window (its directory 404s and the version is absent from the index; the oldest release
still served is v20260715.556894) — so every VM-bedded change failed at the FETCH, before
its own diff could be judged. eval-host-vm is the guest-as-host image behind the
check-local-vm bed, which is why this blocked VM beds rather than one VM.

The six sites now name the release the mirror serves, with the checksum it publishes for
exactly that filename (…cloudimg.qcow2.SHA256 names the file verbatim):

  url:      https://geo.mirror.pkgbuild.com/images/v20261001.604814/Arch-Linux-x86_64-cloudimg.qcow2
  checksum: 360f0fa49db6813bdc8e35bed230a2dc2ae3567b7b5ab74719c0a706e4e34e87

Measured, not assumed: a ranged GET of that URL returns the qcow2 magic (QFI3), and the same
shape serves on the oldest released version — so the SHAPE was never the problem, the VERSION
was. An earlier reading of mine claimed the shape was gone too; it had probed
cloudimg-v<version>, a spelling the current main does not use. That correction is recorded in
the PR body rather than quietly dropped.

The durability risk that remains is named rather than hidden: the mirror PRUNES release
directories, so v20261001.604814 will age out in turn — filed as opencharly/charly#844.

Gate: check-local-vm (disposable: true) — vm-build (the fetch AND the checksum verification),
then vm-create, deploy-add, check-live, update, rebuild-ready, check-live-rebuild, cleanup,
cleanup-members: rc=0, PASS (steps=10), summary.yml ok=true. charly box validate: 0 warnings,
0 errors.

Assisted-by: DeepSeek Harness ollama-cloud/deepseek-v4.1-flash (fully tested and validated)