cook: two default dishes (phyllomeos, phyllomeos-headless) + guest/experimental tiers; CI builds raw images

Manifest groups get a tier; only `default` is generated (make all TIER=...,
--tier). Default: phyllomeos (GNOME + virt-manager) and phyllomeos-headless,
Fedora 44, systemd-boot, CPU-agnostic hypervisor ingredient (hypervisor_type:
any). guest tier: guest-server, guest-desktop. experimental: biosboot/grub,
encrypted, rawhide. Generator clears stale recipes/dishes before writing.

build-image.sh: --dish and --tier; deploy.sh: --tier. build-iso.yaml replaced
by build-image.yaml: raw images for both editions on the fedora:host runner
(TMPDIR=/var/tmp, max-parallel 1), attached with the flattened kickstarts to
tagged releases. Live edition no longer built.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

cook/recipes_manifest.yaml

@@ -2,52 +2,87 @@
 # Define all recipe variants using ingredients from recipe_templates.yaml.
 # Edit this file to add new variants, then run: make all
 #
+# Tiers: every group belongs to a tier (default: "default"). Only the requested
+# tier is generated, so the default build stays tiny:
+#   default       -- the two shipping editions (phyllomeos, phyllomeos-headless)
+#   guest         -- Fedora VM guests to deploy on a Phyllome OS host
+#   experimental  -- one-off variants for testing new dishes
+# Build a tier with:  make all TIER=guest   (or: TIER="default guest", TIER=all)
+# Lint always covers every tier.
+#
 # Syntax:
-# - Single values: repository: "43"
-# - List values: repository: ["43", "44", "rawhide"] (expands to multiple variants)
+# - Single values: repository: "44"
+# - List values: repository: ["43", "44"] (expands to multiple variants)
 # - Booleans: hardware-support: true / false (feature flags)
 #
-# NOTE: List values create a cartesian product.
-# Example: repository: ["43", "44", "rawhide"] + storage: ["standard", "encrypted"]
-# creates 6 variants: (43,standard), (43,encrypted), (44,standard), (44,encrypted),
-# (rawhide,standard), (rawhide,encrypted)
+# NOTE: List values create a cartesian product. Keep it out of the default and
+# guest tiers; prefer one hand-written variant per experimental dish.
 #
 # NOTE: The 'name' field prefixes every generated dish/recipe filename, e.g.
-# the group below yields dishes like desktop_43_gnome_standard_grub_guest-agents.cfg.
+# the "phyllomeos" group yields phyllomeos_44_standard_systemd-boot_...cfg.
 
 recipes:
-  # Desktop variants
-  - name: desktop
-    variants:
-      - repository: ["43", "44", "rawhide"]
-        desktop: gnome
-        storage: ["standard", "encrypted"]
-        bootloader: ["grub", "systemd-boot"]
-        hardware-support: [true, false]
-        guest-agents: [true, false]
+  # --- default tier: the two shipping editions -------------------------------
 
-  # Server variants
-  - name: server
+  # Phyllome OS with a GUI (GNOME + virt-manager)
+  - name: phyllomeos
+    tier: default
     variants:
-      - repository: ["44"]
+      - repository: "44"
+        desktop: gnome
         storage: standard
         bootloader: systemd-boot
+        security: enabled
+        initial-setup: gnome
+        hardware-support: true
+        guest-agents: true
+        hypervisor: desktop
+        hypervisor_type: any
+
+  # Headless Phyllome OS
+  - name: phyllomeos-headless
+    tier: default
+    variants:
+      - repository: "44"
+        storage: standard
+        bootloader: systemd-boot
+        security: enabled
+        initial-setup: server
+        hardware-support: true
+        guest-agents: true
+        hypervisor: base
+        hypervisor_type: any
+
+  # --- guest tier: VMs to deploy on a Phyllome OS host -------------------------
+
+  - name: guest-server
+    tier: guest
+    variants:
+      - repository: "44"
+        storage: standard
+        bootloader: systemd-boot
+        security: enabled
+        initial-setup: server
         hardware-support: false
         guest-agents: true
-        initial-setup: server
 
-  # Hypervisor variants
-  - name: hypervisor
+  - name: guest-desktop
+    tier: guest
     variants:
-      - repository: ["44"]
+      - repository: "44"
+        desktop: gnome
         storage: standard
         bootloader: systemd-boot
-        hardware-support: true
-        guest-agents: false
-        hypervisor: base
-        hypervisor_type: intelcpu
-  # Desktop-hypervisor variants
-  - name: desktop-hypervisor
+        security: enabled
+        initial-setup: gnome
+        hardware-support: false
+        guest-agents: true
+
+  # --- experimental tier: single variants, no matrices -------------------------
+
+  # BIOS (legacy firmware) laptop: GPT + biosboot partition, GRUB
+  - name: exp-bios-desktop-hypervisor
+    tier: experimental
     variants:
       - repository: "44"
         desktop: gnome
@@ -58,14 +93,32 @@ recipes:
         hardware-support: true
         guest-agents: false
         hypervisor: desktop
-        hypervisor_type: intelcpu
+        hypervisor_type: any
 
-  # Live desktop ISO variants (built with livemedia-creator --make-iso)
-  - name: live-desktop
+  # Encrypted root
+  - name: exp-encrypted-headless
+    tier: experimental
     variants:
       - repository: "44"
-        desktop: gnome
-        storage: livefs
-        bootloader: grub
+        storage: encrypted
+        bootloader: systemd-boot
+        security: enabled
+        initial-setup: server
+        hardware-support: true
         guest-agents: true
-        live: true
+        hypervisor: base
+        hypervisor_type: any
+
+  # Rawhide
+  - name: exp-rawhide-headless
+    tier: experimental
+    variants:
+      - repository: rawhide
+        storage: standard
+        bootloader: systemd-boot
+        security: enabled
+        initial-setup: server
+        hardware-support: true
+        guest-agents: true
+        hypervisor: base
+        hypervisor_type: any