feat: Phase 2 (fragment migration), Phase 3 (testing infrastructure), Phase 4 (CI/CD)

Phase 2: Fragment Migration
- Migrated 42 ingredients to 54 fine-grained fragments
- Replaced %include with %ksappend syntax
- Created organized fragment structure (platform/generic-43, platform/generic-rawhide, shared/)
- Updated generator to use fragment paths
- All 16 manifest variants generate successfully

Phase 3: Testing Infrastructure
- Created containerized test runner (tests/container/)
- Added integration test suite (tests/integration/)
- Created golden master fixtures (tests/fixtures/expected_recipes/)
- 41 tests passing (36 unit + 5 integration)
- 54 fragments, 16 recipes validated

Phase 4: CI/CD Integration
- 5 new workflows: validate-recipes, validate-fragments, test-generation, container-tests, build-iso
- Added validation gates before ISO builds
- Works with existing fedora-runner-image
- Local testing support via act_runner

fragments/shared/core/base.ks

@@ -0,0 +1,5 @@
+# Core base kickstart configuration
+# Common settings for all Phyllome OS installations
+
+text # Kickstart installation in text mode
+poweroff # Shut down the system after a successful installation

fragments/shared/core/locale.ks

@@ -0,0 +1,5 @@
+# Keyboard, language, and timezone configuration
+
+keyboard --xlayouts='ch (fr)' # Set keyboard layouts for Romandy
+lang en_US.UTF-8 # Set system language to American English. More languages could be supported: --addsupport=cs_CZ,de_DE,en_UK
+timezone Europe/Zurich --utc # Set system timezone to Zurich

fragments/shared/core/network.ks

@@ -0,0 +1,3 @@
+# Network configuration
+
+network  --onboot=yes --bootproto=dhcp --device=link --activate --hostname=phyllome-alpha # Configure network devices, enable them at boot time device and sets a particular hostname. "link" selects the first device reaching an up state

fragments/shared/core/security/disabled.ks

@@ -0,0 +1,5 @@
+# Security configuration - disabled mode
+
+rootpw --plaintext 1234 --allow-ssh # Root account is enabled with weak password and allow ssh
+selinux --disabled # Disable SELinux
+firewall --enabled --ssh # Reject incoming connections that are not in response to outbound requests except SSH

fragments/shared/core/security/enabled.ks

@@ -0,0 +1,5 @@
+# Security configuration - enabled mode
+
+rootpw --lock # No root login from the console
+selinux --enforcing # Set SELinux to enforcing mode
+firewall --enabled # Enable firewall

fragments/shared/core/services.ks

@@ -0,0 +1,3 @@
+# System services
+
+services --enabled=NetworkManager,systemd-resolved # List of comma-separated systemd services that can be explicitly enabled