Add a read-only appliance image with a dm-verity protected store

nixosModules.image builds a GPT disk image with systemd-repart: ESP with a
UKI carrying the store's verity root hash, an erofs /nix/store on a
dm-verity partition, a tmpfs root, an immutable /etc overlay and an ext4
state partition on /var. No Nix on the device; it is replaced as a whole.

The store is made with 4 KiB erofs blocks: systemd-repart passes the 512
byte sector size to mkfs.erofs, and libblkid cannot verify the checksum of
such a superblock, so udev never reported the file system and the initrd
waited forever for /dev/mapper/usr.

examples/image (nix build .#image) is a hardware test build with a debug
console password; checks.image boots the image under UEFI.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

flake.nix

@@ -21,6 +21,8 @@
         # The installer pieces; `lib.mkInstaller` wires them up.
         installer = ./modules/installer/install-script.nix;
         installer-iso = ./modules/installer/iso.nix;
+        # Appliance disk image: dm-verity store, volatile root, state on /var.
+        image = ./modules/image;
       };
 
       # Installer ISO for a given nixosSystem:
@@ -66,6 +68,19 @@
         ];
       };
 
+      # Appliance image (verity store, volatile root) for trying on hardware:
+      #   nix build .#image   ->  result/*.raw
+      nixosConfigurations.image = nixpkgs.lib.nixosSystem {
+        system = "x86_64-linux";
+        modules = [
+          self.nixosModules.router
+          self.nixosModules.image
+          ./examples/image
+        ];
+      };
+
+      packages.x86_64-linux.image = self.nixosConfigurations.image.config.system.build.image;
+
       # `nix run .#deploy -- <flake-attr> <user@host>`: activate a new
       # configuration with commit-confirm; see scripts/deploy.sh.
       apps.x86_64-linux.deploy =