feat(os-image): ReDroid 16 GMS H264 VM image + dual-arch CI to ghcr

[CMGS]

Ubuntu 22.04 + Docker + ReDroid 16 GMS VM image where the Android container is baked restart-primed: build.sh creates + arms a --restart container in a privileged DinD via a one-shot bake wrapper, so the VM's dockerd replays it on boot and Android cold-boots there — no first-boot docker create, no launcher service, and the vfs create-copy is off the run/start path.

Image contents (Android 16)

• Google Play services (GMS), Play Store, Google Services Framework, Chrome + Trichrome — GApps overlay carved from Google's pinned API-36 Play Store system image.
• Fossify as the sole HOME — a first-boot hook disables Launcher3 once Fossify is the resolved HOME, so Android never shows the "Select Home app" chooser; libndk_translation for ARM-on-x86 (amd64 only).
• Camera2 and the Chromium WebView test shell (Browser2) are removed; Android System WebView is kept.
• 720x1280, 320 dpi, 60 fps, 8 Mbit/s scrcpy H.264 over one RFB :5900 (H.264 passthrough + Tight/JPEG fallback), ADB on :5555, public DNS (8.8.8.8/1.1.1.1).

Networking fix

systemd-networkd's 20-wired Name=e* v* uplink match also grabbed Docker's veth* interfaces and raced Docker's bridge enslavement, deterministically leaving the container's veth off docker0 on some builds (docker0 linkdown, no container network, adb offline). A higher-priority 05-docker-unmanaged.network (Unmanaged=yes for veth*/docker0/br-*) keeps networkd off Docker's links so the veth stays enslaved on every boot.

First-boot setup (fossify-home.sh, on sys.boot_completed)

The portable GApps overlay carves only product/system_ext, so GMS Core ships as a system-only APK with no usable Chimera modules (Chrome's Dynamite/certificate lookups then fail and it crashes). The hook stages the identical signed GMS container APK once as a /data/app update so its embedded Chimera modules load, then makes Fossify the sole HOME. The /var/lib/redroid-data /data bind persists, so later boots are only a path check.

Portable, restart-primed bake

The container ENTRYPOINT is a static-BusyBox cocoon-bake-init wrapper. At bake it removes a one-shot marker and sleeps without booting Android, so the CI runner needs no binder/ashmem/native-arch (arm64 bakes with no qemu). In the VM the marker is gone, so the wrapper execs /init and Android boots normally. This keeps use_memfd=0 (the VM's Jammy kernel provides ashmem_linux).

Disk

vfs stores the ReDroid image layer, the container, and its init layer as three near-identical ~1.3 G copies. A hardlink pass over /var/lib/docker/vfs/dir before taring ships them once — safe because in the VM /var/lib/docker is a read-only EROFS lower under overlayfs (every container write copies up, never mutating a shared inode). Image size 4.3 GiB → 1.75 GiB (−59%).

GApps sourcing (prepare-gapps16.sh)

Resolves + downloads the pinned API-36 Play Store system image (per-arch zip + SHA-1, env-overridable), extracts the super partition from system.img's GPT, lpunpacks product.img + system_ext.img, and runs prepare-gapps16-inner.sh to emit gapps16-<abi>.tar. Only the raw Google zip is cached; the derived overlay is never committed.

CI (folded into build-os-images.yml, no dedicated workflow)

The shared build-os-images.yml runs an optional per-image ci-prepare.sh hook (hashFiles-gated, a no-op for every other image) that carves GApps and bakes both arches on one runner — amd64 native, arm64 emulated under QEMU (qemu binfmt registered inside the DinD) — into docker-data-<arch>.tar. A single multi-platform build-push-action then builds the VM image (each platform ADDing its own tar), runs verify-vm-inner.sh in both solves, and pushes a real multi-arch OCI index.

• A publish-as file remaps the family/tag to android:16.0-gms-h264; the canonical tag publishes only from master, while the always-on -<sha> tag gives a pullable pre-merge ref (android:16.0-gms-h264-<sha>). A feature-branch build (via workflow_dispatch -f only=…) therefore never clobbers the release tag.
• No .skip-generic-build, no per-arch native runners, no manifest-stitch job, no binder preflight — the sleep-only bake wrapper needs none of them.

Validation (real hardware, from the GHCR-pulled image)

cocoon image pull → cocoon vm run (CH dev): container Up (restarts=0), Android 16 boot_completed=1, veth on docker0 / docker0 UP on every boot, ping + DNS OK. :5555 (adb) and :5900 (VNC) reachable ~0–28 s after vm start; four stop/start cycles all clean (not start-once). GMS/Play/Chrome/GSF/Fossify present, Camera2/webview-shell absent, use_memfd=0, 60 fps. Google Play renders its sign-in UI and Finsky reaches play.googleapis.com; GMS checkin provisions android_id — GApps are functional and networked. External adb connect <vm-ip>:5555 → device → adb shell works; cocoon vm exec (vsock) reliable. Both arches build + push green.