feat: vminstall.sh installs any boot loader and the Steamify ISO's Steamify step, with a package cache

VM_BOOTLOADER=limine|systemd-boot|grub, VM_STEAMIFY (steamify-install runs after
the headless installer, like Calamares does), VM_CACHE (host pacman cache shared
as 9p, default ~/vms/pkg-cache). run.sh --headless / VM_HEADLESS=1: no window.

Fixes found on the way: the live script deadlocked on is-system-running (it is
the running kernel-command-line.service) and now waits for pacman-init; the post
script kept forcing the Plasma login over Steamify's gaming-mode SDDM, gave
systemd-boot no timeout/default (it waited in the menu for ever), and left ufw
blocking the host's ssh; the first-boot check wanted plasmashell in gaming mode.

share/vminstall-live.sh

@@ -30,11 +30,25 @@ curl -fsS "$H/vminstall-post.sh" -o /tmp/vminstall-post.sh || fail "no vminstall
 ) &
 while sleep 20; do up; done &
 
-systemctl is-system-running --wait >/dev/null 2>&1
+# No `systemctl is-system-running --wait`: this script is itself the running
+# kernel-command-line.service job, so the boot never finishes while it waits.
+# The live keyring must exist before pacman-key can sign (the install failed with
+# "no secret key available to sign with" when this ran first).
+for _ in $(seq 120); do systemctl is-active --quiet pacman-init.service && break; sleep 2; done
 nm-online -t 180 >/dev/null || fail "no network"
 # The live ISO's mirror list and keys can be old; the installer's pacstrap needs current ones.
 pacman -Sy --noconfirm archlinux-keyring cachyos-keyring || echo "(keyring update failed, going on)"
 
+# The host's package cache (VM_CACHE, 9p tag `cache`) as pacman's cache: the
+# installer's pacstrap -c uses the live system's, so a second install downloads nothing.
+CACHE=/var/cache/steamify-pkg
+if mkdir -p $CACHE && mount -t 9p -o trans=virtio,version=9p2000.L cache $CACHE 2>/dev/null; then
+    mkdir -p $CACHE/pkg && mount --bind $CACHE/pkg /var/cache/pacman/pkg &&
+        echo "== package cache: $(ls $CACHE/pkg | wc -l) files from the host"
+else
+    CACHE=""; echo "== no package cache (VM_CACHE off)"
+fi
+
 echo "== cachyos-installer"
 cachyos-installer --config /tmp/settings.json || fail "cachyos-installer exited with $?"
 
@@ -46,6 +60,26 @@ if ! mountpoint -q /mnt; then
 fi
 [[ -d "/mnt/home/$VM_USER" ]] || fail "the installer created no /home/$VM_USER"
 
+# Steamify's packages (Steam, ...) install inside the new system: same cache.
+if [[ -n "$CACHE" ]]; then
+    mkdir -p /mnt/var/cache/pacman/pkg && mount --bind $CACHE/pkg /mnt/var/cache/pacman/pkg || echo "(no cache in the new system)"
+fi
+
+# What Calamares does after its users step (shellprocess_steamify): Steamify's
+# setup for the new user. The headless installer skips it, so a Steamify ISO
+# would otherwise leave plain CachyOS. VM_STEAMIFY: the page's choice (ids,
+# comma-separated; empty = its default, everything on; none = skip).
+if [[ -x /usr/local/bin/steamify-install && "${VM_STEAMIFY:-}" != skip ]]; then
+    echo "== steamify-install (${VM_STEAMIFY:-defaults})"
+    /usr/local/bin/steamify-install /mnt "$VM_USER" "${VM_STEAMIFY:-}"
+    cat "/mnt/var/log/steamify-install.log" 2>/dev/null
+    grep -q '^exit: 0' /mnt/var/log/steamify-install.log 2>/dev/null || fail "steamify-install did not finish cleanly"
+else
+    echo "== no steamify-install on this ISO (or VM_STEAMIFY=skip): plain CachyOS"
+fi
+
+mountpoint -q /mnt/var/cache/pacman/pkg && umount /mnt/var/cache/pacman/pkg
+
 echo "== test VM setup"
 cp /tmp/vminstall-post.sh /tmp/vminstall.env /mnt/root/
 arch-chroot /mnt bash /root/vminstall-post.sh || fail "test VM setup exited with $?"

share/vminstall-post.sh

@@ -23,11 +23,18 @@ chmod 440 /etc/sudoers.d/99-test-vm
 
 # Log straight into Plasma (gamescope doesn't render in the VM). The
 # scripts expect plasma-login-manager, like a CachyOS install from Calamares.
-pacman -Q plasma-login-manager >/dev/null 2>&1 || pacman -S --needed --noconfirm plasma-login-manager
-systemctl disable sddm.service 2>/dev/null || true
-systemctl enable plasmalogin.service
-mkdir -p /etc/plasmalogin.conf.d
-printf '[Autologin]\nUser=%s\nSession=plasma.desktop\n' "$VM_USER" > /etc/plasmalogin.conf.d/00-test-autologin.conf
+# Not when Steamify's conversion is on (steamify-install ran on a Steamify
+# ISO): it made SDDM boot into gamescope, and that is what gets tested; sshd
+# doesn't need a desktop.
+if [[ -f /etc/sddm.conf.d/10-gamescope-autologin.conf ]]; then
+    echo "Steamify's gaming-mode login (SDDM) kept."
+else
+    pacman -Q plasma-login-manager >/dev/null 2>&1 || pacman -S --needed --noconfirm plasma-login-manager
+    systemctl disable sddm.service 2>/dev/null || true
+    systemctl enable plasmalogin.service
+    mkdir -p /etc/plasmalogin.conf.d
+    printf '[Autologin]\nUser=%s\nSession=plasma.desktop\n' "$VM_USER" > /etc/plasmalogin.conf.d/00-test-autologin.conf
+fi
 
 # cachyos-installer's limine.conf has no default_entry: entry 1 is the
 # "CachyOS" folder, so the first boot waits in the menu. 2 is its first
@@ -36,6 +43,19 @@ if [[ -f /boot/limine.conf ]] && ! grep -q '^default_entry:' /boot/limine.conf;
     sed -i 's/^timeout: .*/&\ndefault_entry: 2/' /boot/limine.conf
 fi
 
+# cachyos-installer's systemd-boot loader.conf has `#timeout 3` commented out and
+# no default: the first boot would wait in the menu for ever. Boot the first
+# kernel after 3 s.
+if [[ -f /boot/loader/loader.conf ]] && ! grep -q '^timeout' /boot/loader/loader.conf; then
+    printf 'timeout 3\ndefault linux-cachyos.conf\n' >> /boot/loader/loader.conf
+fi
+
+# The installer enables ufw, which drops the host's ssh connections (found
+# in the kernel log: [UFW BLOCK] DPT=22). Let ssh in; the rest stays as installed.
+if command -v ufw >/dev/null; then
+    ufw allow 22/tcp || echo "(ufw rule failed: ssh may be blocked)"
+fi
+
 # English everywhere, whatever the live ISO picked.
 echo 'LANG=en_US.UTF-8' > /etc/locale.conf