cook: two default dishes (phyllomeos, phyllomeos-headless) + guest/experimental tiers; CI builds raw images

Manifest groups get a tier; only `default` is generated (make all TIER=...,
--tier). Default: phyllomeos (GNOME + virt-manager) and phyllomeos-headless,
Fedora 44, systemd-boot, CPU-agnostic hypervisor ingredient (hypervisor_type:
any). guest tier: guest-server, guest-desktop. experimental: biosboot/grub,
encrypted, rawhide. Generator clears stale recipes/dishes before writing.

build-image.sh: --dish and --tier; deploy.sh: --tier. build-iso.yaml replaced
by build-image.yaml: raw images for both editions on the fedora:host runner
(TMPDIR=/var/tmp, max-parallel 1), attached with the flattened kickstarts to
tagged releases. Live edition no longer built.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

cook/Makefile

@@ -1,6 +1,9 @@
 .PHONY: help generate lint validate inventory test install-deps clean clean-recipes clean-dishes all
 
 PYTHON ?= python3
+# Manifest tier(s) to generate: default, guest, experimental, all (space-separated)
+TIER ?= default
+TIER_ARGS = $(foreach t,$(TIER),--tier $(t))
 
 default: all
 
@@ -9,6 +12,7 @@ help:
 	@echo ""
 	@echo "Available targets:"
 	@echo "  all          - Generate recipes and dishes, lint, and validate (default)"
+	@echo "                 TIER=default|guest|experimental|all picks the manifest tier(s)"
 	@echo "  generate     - Same as 'all'"
 	@echo "  lint         - Lint manifest and templates without writing files"
 	@echo "  validate     - Validate existing dishes without regenerating"
@@ -22,13 +26,13 @@ help:
 all: generate
 
 generate:
-	@$(PYTHON) generate_recipe.py
+	@$(PYTHON) generate_recipe.py $(TIER_ARGS)
 
 lint:
 	@$(PYTHON) generate_recipe.py --no-generate --no-validate
 
 validate:
-	@$(PYTHON) generate_recipe.py --no-generate --no-lint
+	@$(PYTHON) generate_recipe.py $(TIER_ARGS) --no-generate --no-lint
 
 inventory:
 	@$(PYTHON) generate_recipe.py --inventory