cook: two default dishes (phyllomeos, phyllomeos-headless) + guest/experimental tiers; CI builds raw images

Manifest groups get a tier; only `default` is generated (make all TIER=...,
--tier). Default: phyllomeos (GNOME + virt-manager) and phyllomeos-headless,
Fedora 44, systemd-boot, CPU-agnostic hypervisor ingredient (hypervisor_type:
any). guest tier: guest-server, guest-desktop. experimental: biosboot/grub,
encrypted, rawhide. Generator clears stale recipes/dishes before writing.

build-image.sh: --dish and --tier; deploy.sh: --tier. build-iso.yaml replaced
by build-image.yaml: raw images for both editions on the fedora:host runner
(TMPDIR=/var/tmp, max-parallel 1), attached with the flattened kickstarts to
tagged releases. Live edition no longer built.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

build-image.sh

@@ -6,7 +6,12 @@
 # (e.g. `virtpull local ./build/<dish>.img --wonder-vm NAME`) instead of a
 # bootable ISO.
 #
-# Usage: ./build-image.sh [--as qcow2] [--root-size MiB] [--extra-ks FILE]
+# Usage: ./build-image.sh [--dish NAME] [--tier TIER] [--as qcow2]
+#                         [--root-size MiB] [--extra-ks FILE]
+#
+# --dish skips the interactive picker (used by CI); --tier selects which
+# manifest tier of dishes to generate (default: default; see
+# cook/recipes_manifest.yaml).
 #
 # Requires: lorax-lmc-novirt (livemedia-creator), qemu-img, and root (the
 # --no-virt disk install needs real loop-device access via
@@ -31,10 +36,20 @@
 set -euo pipefail
 
 AS_FORMAT=""
+DISH=""
+TIER="${TIER:-default}"
 ROOT_SIZE=8192
 EXTRA_KS=""
 while [[ $# -gt 0 ]]; do
   case "$1" in
+    --dish)
+      DISH="$2"
+      shift 2
+      ;;
+    --tier)
+      TIER="$2"
+      shift 2
+      ;;
     --as)
       AS_FORMAT="$2"
       shift 2
@@ -49,7 +64,7 @@ while [[ $# -gt 0 ]]; do
       ;;
     *)
       echo "Unknown argument: $1"
-      echo "Usage: $0 [--as qcow2] [--root-size MiB] [--extra-ks FILE]"
+      echo "Usage: $0 [--dish NAME] [--tier TIER] [--as qcow2] [--root-size MiB] [--extra-ks FILE]"
       exit 1
       ;;
   esac
@@ -81,15 +96,23 @@ if [[ $EUID -ne 0 ]] && ! sudo -n true 2>/dev/null; then
 fi
 
 # Regenerate recipes and dishes before building (they are build products)
-if ! (cd cook && make all); then
+if ! (cd cook && make all TIER="$TIER"); then
   echo "Failed to generate dishes in cook/ (see 'make all' in cook/)"
   exit 1
 fi
 
-# Pick a dish (shared with deploy/deploy-distro.sh)
-# shellcheck source=./deploy/select-dish.sh
-source "$(dirname "$0")/deploy/select-dish.sh"
-dish="$selected_dish"
+# Pick a dish: --dish, or interactively (shared with deploy/deploy-distro.sh)
+if [[ -n "$DISH" ]]; then
+  dish="${DISH%.cfg}"
+  if [[ ! -f "cook/dishes/${dish}.cfg" ]]; then
+    echo "Dish not found: cook/dishes/${dish}.cfg (is --tier '$TIER' right?)"
+    exit 1
+  fi
+else
+  # shellcheck source=./deploy/select-dish.sh
+  source "$(dirname "$0")/deploy/select-dish.sh"
+  dish="$selected_dish"
+fi
 
 # Derive the target release, same convention as
 # deploy/deploy-distro.sh's find_fedora_iso() (used for --releasever, which