- Add PodmanV0Score/IotScore (adjacent-tagged serde) and PodmanV0Interpret stub
- Gate virt behind kvm feature and podman-api behind podman feature
- Scaffold iot-operator-v0 (kube-rs operator stub) and iot-agent-v0 (NATS KV watch)
- Add PodmanV0 to InterpretName enum
- Fix aarch64 cross-compilation by making kvm/podman optional features
- Align async-nats across workspace, add workspace deps for tracing/toml/tracing-subscriber
- Remove unused deps (serde_yaml from agent, schemars from operator)
- Add Send+Sync to CredentialSource, fix &PathBuf → &Path, remove dead_code allow
- Update 5 KVM example Cargo.tomls with explicit features = ["kvm"]

@@ -0,0 +25,4 @@
+/// deliberately Ansible-agnostic so a Rust-native impl can be dropped in
+/// later without Score changes.
+#[async_trait]
+pub trait HostConfigurationProvider: Send + Sync {

@@ -0,0 +35,4 @@
+pub struct IotDeviceSetupConfig {
+    /// Stable device identifier. Written into the agent's TOML and used
+    /// as the KV key prefix (`<device_id>.<deployment>`).
+    pub device_id: String,

@@ -0,0 +52,4 @@
+
+impl IotDeviceSetupConfig {
+    /// Render the agent's `/etc/iot-agent/config.toml` content.
+    pub fn render_toml(&self) -> String {

@@ -0,0 +87,4 @@
+    /// Render the systemd unit file content.
+    pub fn render_systemd_unit(&self) -> String {
+        String::from(
+            "[Unit]

@@ -0,0 +45,4 @@
+    cfg: &CloudInitSeedConfig<'_>,
+    output_dir: &Path,
+) -> Result<PathBuf, KvmError> {
+    if which_xorriso().await.is_none() {

@@ -0,0 +121,4 @@
+}
+
+fn render_user_data(cfg: &CloudInitSeedConfig<'_>) -> String {
+    let mut s = String::new();

@@ -0,0 +15,4 @@
+/// `VirtualMachineHost` capability can be introduced then, and we'll
+/// either implement it *in terms of* `KvmHost` or drop `KvmHost`
+/// altogether.
+pub trait KvmHost {

@@ -0,0 +43,4 @@
+    }
+
+    async fn ensure_ready(&self) -> Result<PreparationOutcome, PreparationError> {
+        // The executor holds the URI — a cheap hypervisor-version query is

@@ -0,0 +66,4 @@
+/// if a domain with this name already exists.
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct KvmVmScore {
+    pub config: CloudInitVmConfig,

@@ -0,0 +133,4 @@
+            tokio::fs::create_dir_all(&cfg.seed_output_dir)
+                .await
+                .map_err(|e| InterpretError::new(format!("create seed dir: {e}")))?;
+            let status = Command::new("qemu-img")

@@ -0,0 +9,4 @@
+//! `podman-api` over shelling to `podman` elsewhere — use the mature
+//! upstream where it's mature (apt/systemd/user module idempotency),
+//! don't adopt its orchestration model (playbooks, inventory, YAML
+//! templating, the Kubespray mess).

@@ -0,0 +58,4 @@
+        // keeps re-runs cheap: the update is skipped if the cache was
+        // refreshed within the last hour.
+        //
+        // When we grow RHEL-family support, switch on the distro

@@ -0,0 +108,4 @@
+        host: IpAddress,
+        creds: &SshCredentials,
+        spec: &FileSpec,
+    ) -> Result<ChangeReport, ExecutorError> {

@@ -0,0 +170,4 @@
+        spec: &SystemdUnitSpec,
+    ) -> Result<ChangeReport, ExecutorError> {
+        // Step 1: write the unit file.
+        let (unit_path, scope_user) = match &spec.scope {

@@ -0,0 +256,4 @@
+        .await
+    }
+
+    pub async fn ensure_linger(

@@ -0,0 +377,4 @@
+
+        let mut cmd = Command::new(&bins.ansible);
+        cmd.arg("all")
+            .arg("-i")

@@ -0,0 +1,71 @@
+apiVersion: apiextensions.k8s.io/v1

@@ -0,0 +78,4 @@
+    };
+    obj.extensions.insert(
+        "x-kubernetes-validations".to_string(),
+        serde_json::json!([{