cook: two default dishes (phyllomeos, phyllomeos-headless) + guest/experimental tiers; CI builds raw images

Manifest groups get a tier; only `default` is generated (make all TIER=...,
--tier). Default: phyllomeos (GNOME + virt-manager) and phyllomeos-headless,
Fedora 44, systemd-boot, CPU-agnostic hypervisor ingredient (hypervisor_type:
any). guest tier: guest-server, guest-desktop. experimental: biosboot/grub,
encrypted, rawhide. Generator clears stale recipes/dishes before writing.

build-image.sh: --dish and --tier; deploy.sh: --tier. build-iso.yaml replaced
by build-image.yaml: raw images for both editions on the fedora:host runner
(TMPDIR=/var/tmp, max-parallel 1), attached with the flattened kickstarts to
tagged releases. Live edition no longer built.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -10,7 +10,7 @@ Provided that some dependencies are met (`libvirt` is running on your computer,
 chmod +x deploy.sh
 ```
 
-- Execute it and pick a dish, e.g. `desktop_44_standard_grub_gnome_guest-agents`, when prompted:
+- Execute it and pick a dish when prompted (by default the two Phyllome OS editions; see [Editions and tiers](#editions-and-tiers)). The example below is from an earlier, larger matrix:
 
 ```
 ./deploy.sh
@@ -35,9 +35,28 @@ Allocating 'desktop_44_standard_grub_gnome_guest-agents.img'
 Creating domain...                              
 ```
 
-`deploy.sh` regenerates the `recipes` and `dishes` (they are build products) before deploying.
+`deploy.sh` regenerates the `recipes` and `dishes` (they are build products) before deploying. Pass `--tier guest` to deploy a plain Fedora server or desktop VM on a Phyllome OS host instead.
 After a successfull installation, the virtual machine will shutdown and be ready to use when powered on again.
 
+## Editions and tiers
+
+The repo ships a recipe to deploy Phyllome OS on a target host, not a general-purpose kickstart collection. Only two dishes are generated by default (Fedora 44, UEFI, systemd-boot, both with hardware support and guest agents so they also run as VMs):
+
+| Dish (prefix) | What it is |
+|---|---|
+| `phyllomeos` | Phyllome OS with a GUI (GNOME + virt-manager) |
+| `phyllomeos-headless` | Headless Phyllome OS |
+
+Every group in `cook/recipes_manifest.yaml` belongs to a *tier*, and only the requested tier is generated:
+
+| Tier | Contents | Build with |
+|---|---|---|
+| `default` | the two editions above | `make all` |
+| `guest` | `guest-server`, `guest-desktop`: Fedora VMs to deploy on a Phyllome OS host | `make all TIER=guest` |
+| `experimental` | single hand-written variants to try new dishes (BIOS/GRUB, encrypted root, rawhide) | `make all TIER=experimental` |
+
+`TIER=all` (or `TIER="default guest"`) combines tiers; `deploy.sh` and `build-image.sh` take `--tier`. Lint always covers every tier, so inactive tiers cannot rot. To test a new dish, add one variant (no list-valued matrices) to an `experimental` group.
+
 ## Building a disk image (no libvirt/virt-install)
 
 `deploy.sh` drives a live `virt-install`/libvirt session. If you just want a
@@ -48,11 +67,11 @@ use `build-image.sh` instead. It runs `livemedia-creator --no-virt
 bootable ISO:
 
 ```
-./build-image.sh [--as qcow2] [--root-size MiB] [--extra-ks FILE]
+./build-image.sh [--dish NAME] [--tier TIER] [--as qcow2] [--root-size MiB] [--extra-ks FILE]
 ```
 
-It picks a dish the same way `deploy.sh` does and writes the result under
-`./build/`. Requires `lorax-lmc-novirt` (heavier than `deploy.sh`'s plain
+It picks a dish the same way `deploy.sh` does (or takes `--dish NAME`) and writes the result under
+`./build/`. The `build-image` CI workflow runs it for both default editions on every push to `main`, and on `v*.*.*` tags it attaches the compressed raw images (`.img.xz`) and the flattened kickstart files to the release. Requires `lorax-lmc-novirt` (heavier than `deploy.sh`'s plain
 QEMU/libvirt prerequisites, not installed by
 `deploy/install-prerequisites-on-linux.sh`) and root — the `--no-virt` disk
 install needs real loop-device access (`/dev/loop-control`), which a
@@ -123,7 +142,7 @@ cd cook && make all
 Alternatively, for a bespoke dish not part of the matrix, append the ingredient directly to an existing recipe and re-flatten it:
 
 ```
-echo "%include ../ingredients/extra-luanti.ks # Sandbox video game engine" >> cook/recipes/desktop_44_standard_grub_gnome.cfg
+echo "%include ../ingredients/extra-luanti.ks # Sandbox video game engine" >> cook/recipes/<recipe>.cfg
 cd cook && make generate
 ```
 
@@ -135,12 +154,13 @@ cd cook && make generate
 cd cook && make inventory
 ```
 
-- Define a new edition (a group named e.g. `server`) in `cook/recipes_manifest.yaml` with the desired variants; the cartesian product of its list values generates one dish per combination.
+- Define a new group in `cook/recipes_manifest.yaml` with a `tier` (use `experimental` for anything that should not be built by default); the cartesian product of its list values generates one dish per combination, so keep it to a single variant.
 
 ### Useful targets (in `cook/`)
 
 ```
-make all         # generate recipes + dishes, lint, and validate (default)
+make all         # generate the default tier's dishes, lint, and validate
+make all TIER=guest   # ... or the guest / experimental / all tiers
 make lint        # check the manifest/templates without writing files
 make validate    # validate existing dishes
 make inventory   # print the ingredient catalog derived from the templates