Stabilize Incus builds, host setup, and networking

[Llewellynvdm]

Summary

This release-candidate stabilization consolidates the Linux, Incus networking, image-build, Joomla MCP, TypeScript and Python corrections found during end-to-end testing.

• keep host bootstrap fail-closed around APT/dpkg/core utilities and install the newest Incus candidate from repositories the operator already configured
• move bridge and ACL ownership to the Incus default project, use native bridge networks, detect collisions, guard legacy migration, and never modify Docker/firewall policy
• separate image-build resources from runtime sizes, reserve host memory/CPU, check current capacity before mutation, and give exact insufficiency errors without requiring swap
• retain failed builds as owned resumable checkpoints, collect non-secret diagnostics, and reuse a detached managed APT/npm/pip/Playwright cache
• publish verified stopped instances directly and remove the unnecessary sanitized and factory snapshots
• correct vdm-jomla-mcp-live-test, normalize TSX version output, and use the installed pipx path for Python tools
• update the generated manifest, workflows, setup/safety/build docs, changelog and version to 0.3.0-rc.3

Host safety properties

The repository does not add or remove package sources, replace a coreutils provider, install an alternative dd, create an Incus systemd PATH override, modify Docker, or inject firewall rules. Same-named networks/ACLs and retained build instances are changed or deleted only after platform ownership metadata is verified.

An Incus package upgrade is refused when running instances are found unless the operator explicitly acknowledges scheduled downtime. Resource and storage preflight happens before apply-incus.sh or VM creation.

Validation completed

• ./tests/validate-repository.sh
• all shell files parsed with bash -n
• generator consistency: python3 scripts/generate-platform.py --check
• Python compilation for generator and tests
• all repository YAML parsed with PyYAML
• git diff --check
• 14 GiB/8-thread laptop resource cases: safe 8 GiB TypeScript plan when available, fail-closed at 3.4 GiB available, and disk-shortfall rejection
• real execution of the guest Joomla session dispatcher, including exact executable and read-only CLI arguments

Hardware acceptance still required

This remains a draft until real KVM/Incus evidence is collected. Required acceptance includes:

1. the TypeScript image on the 14 GiB Ubuntu 26.04 laptop after enough current memory is available;
2. ./scripts/build-image.sh --clean --no-cache typescript on an independent builder;
3. successful verification, direct publication and launch;
4. an intentional interrupted build followed by checkpoint/cache resume.

The documented limitations continue to state that static/mocked validation is not a substitute for building all six images on real hardware.