Build Fedora aarch64 images for the Lenovo Yoga C630

Assembles a ready-to-write disk image via Gitea Actions. Mainline has carried
sdm850-lenovo-yoga-c630.dts since 5.5 and Fedora ships it in kernel-core, so
unlike aarch64-laptops/build there is no kernel or GRUB to compile — what is
left is producing an image that boots on firmware which hands Linux no device
tree.

The build runs in an aarch64 container under qemu-user and builds filesystems
from directory trees with mke2fs -d and mcopy rather than mounting loop
devices, so it works on runners that will not hand out /dev/loop-control.

A kernel-install hook writes the devicetree line into each BLS entry; without
it the first `dnf update kernel` would produce an unbootable system.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XWRjNJMistCy6ngXH5aJLS

config/device.env

@@ -0,0 +1,50 @@
+# Device parameters for the Lenovo Yoga C630 13Q50 (81JL) — Qualcomm SDM850.
+#
+# Sourced by build/stage2.sh. Everything here is overridable from the
+# environment, so CI can tweak a value without editing this file.
+
+# --- identity -----------------------------------------------------------
+: "${DEVICE_NAME:=lenovo-yoga-c630}"
+: "${DEVICE_DESC:=Lenovo Yoga C630 13Q50}"
+
+# Device tree shipped by Fedora's kernel-core, relative to /boot/dtb-$KVER/.
+: "${DEVICE_DTB:=qcom/sdm850-lenovo-yoga-c630.dtb}"
+
+# --- kernel command line ------------------------------------------------
+#
+# clk_ignore_unused / pd_ignore_unused
+#     The SDM850 clock and power-domain trees are only partially described in
+#     the device tree. Without these the kernel gates clocks and power domains
+#     that nothing has claimed but that the machine still needs, and the boot
+#     dies somewhere between the pivot and the display coming up.
+#
+# efi=noruntime
+#     The C630's EFI runtime services are not usable from Linux. Since 6.7 the
+#     qcom_uefisecapp driver provides efivars through SCM instead, so turning
+#     runtime services off costs nothing and avoids the hangs.
+#
+# arm64.nopauth
+#     Harmless on Cortex-A75/A55 (no pointer auth), kept for parity with the
+#     rest of the Snapdragon WoA laptop fleet.
+: "${DEVICE_CMDLINE:=clk_ignore_unused pd_ignore_unused efi=noruntime arm64.nopauth}"
+
+# Uncomment if USB dies during boot before the Windows DSP firmware has been
+# extracted — the ADSP reset puts the USB-C PHY into high-Z briefly.
+# DEVICE_CMDLINE="$DEVICE_CMDLINE modprobe.blacklist=qcom_q6v5_pas"
+
+# --- image geometry (MiB) -----------------------------------------------
+: "${ESP_SIZE_MIB:=512}"
+: "${BOOT_SIZE_MIB:=1024}"
+
+# Total image size. The root partition takes whatever is left, and grows to
+# fill the target medium on first boot.
+: "${IMAGE_SIZE_MIB:=8192}"
+
+# --- distro -------------------------------------------------------------
+: "${FEDORA_RELEASE:=44}"
+: "${TARGET_ARCH:=aarch64}"
+
+# --- default account ----------------------------------------------------
+# Password is expired at first login, so it must be changed immediately.
+: "${DEFAULT_USER:=fedora}"
+: "${DEFAULT_PASSWORD:=fedora}"