refactor(cook): data-driven recipe generation with in-process flatten and lint

Replace the hardcoded TEMPLATES dict and the ksflatten-relative wrapper
with a single data-driven pipeline:

- recipe_templates.yaml becomes the single source of truth with three
  sections: base (always included), choices (exactly-one per category,
  the invariant pykickstart cannot check) and features (additive flags
  or one-of values)
- generate_recipe.py is a pure YAML consumer: it resolves ingredients,
  renders dishes via pykickstart in-process (no ksflatten binary, no
  %include path munging), lints the invariants pykickstart cannot check
  (exactly-one per choice category, known keys, existing fragments,
  unique filenames) and validates every generated dish
- dish names are derived by a generic rule with canonical category order
  from the templates, independent of YAML key order; no committed
  generated files means no name burn-in
- recipes/ and dishes/ become gitignored build products; the 68 tracked
  generated files (already out of sync with the manifest) are removed
- delete dead ingredients (section-data/, validation/, initial-setup/
  desktop/, live/hypervisor.ks, rpmfusion-nonfree.ks), the stale
  all-ingredients.cfg (replaced by 'make inventory') and the
  bin/generate-recipe and bin/ksflatten-relative wrappers
- Makefile: single 'make all' step plus lint, validate, inventory, test
- add 16 pytest tests covering expansion, selection, naming, lint and
  flatten/validate round-trips

cook/recipe_templates.yaml

@@ -1,56 +1,51 @@
-# Proteus is a template generator for Phyllome OS
-# Fragment paths use relative paths from project root
-# Required elements can all be replaced by a listed modifier
-# Optional elements add features
+# Phyllome OS ingredient templates ("Proteus")
+#
+# Maps recipe variants to kickstart ingredient fragments. Every fragment path
+# is relative to the ingredients/ directory.
+#
+# Sections:
+#   base     -- fragments included in every recipe, in declaration order.
+#   choices  -- "exactly-one" categories. Each variant must resolve to a single
+#               value per category; pykickstart cannot detect two variants of a
+#               choice being enabled at once, so the generator enforces it.
+#               When a variant omits a category, the first declared value is used.
+#   features -- additive fragments a variant enables independently:
+#                 * a plain string  => boolean flag; included when the variant
+#                                      value is truthy (e.g. hardware-support)
+#                 * a dict          => one-of; the variant value selects the
+#                                      matching fragment(s)
 
 name: proteus
 description: "Universal template to generate kickstart recipes for a server, a desktop or a hypervisor system"
-required:
-  repository: 
+
+base:
+  - core/base.ks
+  - core/locale.ks
+  - core/network.ks
+  - core/services.ks
+  - packages/core.ks
+  - packages/fedora-remix.ks
+  - packages/hand-picked.ks
+
+choices:
+  repository:
     "43": repo/fedora-43-mirrors.ks
-  core:
-    "base": core/base.ks
+    rawhide: repo/rawhide-mirrors.ks
+  storage:
+    standard: storage/standard.ks
+    encrypted: storage/encrypted.ks
   bootloader:
-    "grub": bootloader/grub.ks
-  storage:
-    "ext4": storage/standard.ks
-  locale:
-    "fr_CH": core/locale.ks 
-  services:
-    "minimal": core/services.ks
-  network:
-    "network-manager": core/network.ks
-  packages:
-    "core": packages/core.ks
-  brand:
-    "fedora-remix": packages/fedora-remix.ks
-  extra:
-    "extra": packages/hand-picked.ks
+    grub: bootloader/grub.ks
+    systemd-boot: bootloader/systemd-boot.ks
   security:
-    "secure": core/security/enabled.ks
-  initial-setup:
-    "server": initial-setup/server/config.ks
-modifiers:
-  repository: 
-    "rawhide": repo/rawhide-mirrors.ks
-  storage:
-    "encrypted": storage/encrypted.ks
-  security:
-    "disabled": core/security/disabled.ks
+    enabled: core/security/enabled.ks
+    disabled: core/security/disabled.ks
   initial-setup:
+    server: initial-setup/server/config.ks
     gnome: initial-setup/gnome/config.ks
     generic-wayland: initial-setup/generic-wayland/config.ks
-  live: 
-    core:
-      "live-base": livecore/base.ks
-    bootloader:
-      "systemd-boot": live/core/bootloader/systemd-boot.ks
-    packages:
-      "live-core": live/core/packages.ks
-optional:
-  hardware-support: packages/hardware-support.ks
-  guest-agents: guest-agents/base.ks
-  hypervisor: live/hypervisor.ks
+
+features:
   desktop:
     gnome:
       - desktop/gnome/config.ks
@@ -58,10 +53,6 @@ optional:
       - desktop/gnome/post-scripts.ks
     labwc:
       - desktop/labwc/config.ks
-  hypervisor_type:
-    amdcpu: hypervisor/amdcpu.ks
-    intelcpu: hypervisor/intelcpu.ks
-    intelgpu: hypervisor/intelgpu.ks
   hypervisor:
     base:
       - hypervisor/base/packages.ks
@@ -70,7 +61,9 @@ optional:
     desktop:
       - packages/virtual-machine-manager/packages.ks
       - packages/virtual-machine-manager/post-scripts.ks
-  post:
-    live:
-      - base: live/post/base.ks
-      - session: live/post/session.ks
+  hypervisor_type:
+    amdcpu: hypervisor/amdcpu.ks
+    intelcpu: hypervisor/intelcpu.ks
+    intelgpu: hypervisor/intelgpu.ks
+  hardware-support: packages/hardware-support.ks
+  guest-agents: guest-agents/base.ks