Add a read-only appliance image with a dm-verity protected store

nixosModules.image builds a GPT disk image with systemd-repart: ESP with a
UKI carrying the store's verity root hash, an erofs /nix/store on a
dm-verity partition, a tmpfs root, an immutable /etc overlay and an ext4
state partition on /var. No Nix on the device; it is replaced as a whole.

The store is made with 4 KiB erofs blocks: systemd-repart passes the 512
byte sector size to mkfs.erofs, and libblkid cannot verify the checksum of
such a superblock, so udev never reported the file system and the initrd
waited forever for /dev/mapper/usr.

examples/image (nix build .#image) is a hardware test build with a debug
console password; checks.image boots the image under UEFI.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

examples/image/default.nix

@@ -0,0 +1,58 @@
+# A bootable appliance image for trying the verity/read-only layout on real
+# hardware (`nix build .#image`, then write image.raw to a disk). Same network
+# shape as examples/desktop: one NIC, LAN untagged, PPPoE on VLAN 1001.
+#
+# DEBUGGING ONLY: root has the console password `testtest`, readable in the
+# Nix store and this repository. Remove it before any real use.
+{ lib, ... }:
+{
+  imports = [ ../../modules/image ];
+
+  networking.hostName = "router";
+  system.stateVersion = "26.11";
+
+  # Generic UEFI PC: storage, USB keyboard and NIC drivers in the initrd.
+  boot.initrd.availableKernelModules = [
+    "ahci"
+    "nvme"
+    "xhci_pci"
+    "usb_storage"
+    "sd_mod"
+    "virtio_blk"
+    "virtio_pci"
+    "virtio_scsi"
+  ];
+
+  users.users.root.openssh.authorizedKeys.keys = [
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHqyMLgAhEdnrRrd2CeYbphGDMPq/cBDjFJ4q4ItZusn nils@Nilss-Mac-mini.mch.stinnesbeck.com"
+    "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBFxbNNk87tvMxruuKvrryK7iAdf4xgS4xFqjKejNAI6 nils@nixtop"
+  ];
+  users.users.root.password = "testtest";
+  warnings = [
+    "examples/image: root has the well-known debug console password `testtest`; remove it before production use."
+  ];
+
+  router = {
+    enable = true;
+    wan = {
+      interface = "enp2s0";
+      ipv4 = {
+        type = "pppoe";
+        pppoe = {
+          vlan = 1001;
+          username = "CHANGE-ME@isp.example";
+          passwordFile = "/var/lib/router/pppoe-password";
+        };
+      };
+    };
+    lans.main = {
+      interface = "enp2s0";
+      internet = true;
+      ipv4.address = "192.168.10.1";
+      dhcp.pool = {
+        start = "192.168.10.100";
+        end = "192.168.10.199";
+      };
+    };
+  };
+}