Replace Fedora provisioning with NerdOS on NixOS

.gitattributes

@@ -1,2 +1,3 @@
 # Unified patches require a space on otherwise blank context lines.
 scripts/model-usage/integration.patch whitespace=-blank-at-eol
+installer/kiosk/slint-kms.patch whitespace=-blank-at-eol

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -1,19 +1,19 @@
-# `cybex report` opens this form with the environment field prefilled
+# `nerd report` opens this form with the environment field prefilled
 # (?template=bug_report.yml&environment=...). Keep the field ids stable.
 name: Bug report
-description: Something in CybexOS does not work as expected
+description: Something in NerdOS does not work as expected
 title: "[Bug]: "
 labels: [bug]
 body:
   - type: markdown
     attributes:
       value: |
-        Thanks for reporting a problem. Run `cybex report` first: it writes a
-        redacted diagnostic bundle (`cybexos-report-*.tar.gz`) on your computer
+        Thanks for reporting a problem. Run `nerd report` first: it writes a
+        redacted diagnostic bundle (`nerdos-report-*.tar.gz`) on your computer
         and prefills the environment below. Nothing is uploaded for you.
 
         Security problems do not belong here; report them privately as
-        described in [SECURITY.md](https://github.com/DigitalPals/CybexOS/blob/main/SECURITY.md).
+        described in [SECURITY.md](https://github.com/DigitalPals/NerdOS/blob/main/SECURITY.md).
   - type: textarea
     id: summary
     attributes:
@@ -35,15 +35,15 @@ body:
     id: environment
     attributes:
       label: Environment
-      description: Filled in by `cybex report`. Otherwise give the CybexOS version (`cybex version`), whether it was installed from the ISO or a checkout, and your GPU.
+      description: Filled in by `nerd report`. Otherwise give the NerdOS version (`nerd version`), whether it was installed from the ISO or a checkout, and your GPU.
     validations:
       required: true
   - type: textarea
     id: bundle
     attributes:
       label: Diagnostic bundle
       description: >-
-        Drag the `cybexos-report-*.tar.gz` file from `cybex report` into this box.
+        Drag the `nerdos-report-*.tar.gz` file from `nerd report` into this box.
         Look through it first; automatic redaction cannot recognize every private value.
     validations:
       required: false

.github/ISSUE_TEMPLATE/config.yml

@@ -1,11 +1,11 @@
 blank_issues_enabled: false
 contact_links:
   - name: Report a security vulnerability
-    url: https://github.com/DigitalPals/CybexOS/security/advisories/new
+    url: https://github.com/DigitalPals/NerdOS/security/advisories/new
     about: Report vulnerabilities privately. Never open a public issue or attach unredacted logs.
   - name: Documentation
-    url: https://github.com/DigitalPals/CybexOS#readme
+    url: https://github.com/DigitalPals/NerdOS#readme
     about: Installation, updates, recovery, and links to the guides in docs/.
-  - name: Operations and recovery guide
-    url: https://github.com/DigitalPals/CybexOS/blob/main/docs/operations.md
-    about: Commands, update logs, recovery points, and troubleshooting.
+  - name: Recovery guide
+    url: https://github.com/DigitalPals/NerdOS/blob/main/docs/recovery.md
+    about: Deployment recovery, rollback, persistent state, and troubleshooting.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -1,12 +1,12 @@
 name: Feature request
-description: Suggest a change to the CybexOS desktop, installer, or tools.
+description: Suggest a change to the NerdOS desktop, installer, or tools.
 title: "[Feature]: "
 labels: [enhancement]
 body:
   - type: markdown
     attributes:
       value: |
-        CybexOS is deliberately opinionated. A strong automatic default is
+        NerdOS is deliberately opinionated. A strong automatic default is
         preferred over a new setting, and an existing surface (a keybinding,
         the launcher, or a row in an existing Settings page) over a new panel.
         Please search existing issues first.

.github/actionlint.yaml

@@ -0,0 +1,3 @@
+self-hosted-runner:
+  labels:
+    - nerdos-isolated

.github/pull_request_template.md

@@ -1,36 +1,14 @@
-## Summary
+Describe the concrete behavior changed and why.
 
-<!-- What changes and why. Link the issue it resolves, for example "Fixes #123". -->
+Validation:
 
-## Installation paths
+- Source/module tests and candidate desktop checks:
+- Real ISO/installer/updater scenarios exercised:
+- Exact tested source revision and NAR identity:
+- Personal configuration/state and public plugin API coverage:
+- Hardware/security checks, limitations and release blockers:
+- Task-created artifacts retained (path, size, reason) and cleanup:
 
-<!-- The ISO defines the product. A change to the installed product must reach
-both paths in this pull request; see CONTRIBUTING.md. -->
-
-- [ ] Not an installed-product change (documentation, CI, tests, or tooling only)
-- [ ] ISO path covered (image packaging, `cybexos-desktop` RPM, provisioning, rootfs, repair, or reconcile as applicable)
-- [ ] Source-checkout path covered (Ansible roles applied by `./install`)
-- [ ] Parity regression coverage added or extended (for example `image/test_installation_parity.py`, `image/test_desktop_payload.py`, `image/test_installed_policy.py`, `image/test_user_parity.py`)
-- [ ] Saved user choices and user-owned data are preserved
-
-## Documentation
-
-- [ ] User-facing documentation updated (README, `docs/`, `image/README.md`, `agent-skills/cybexos/references/`), or none is affected
-
-## Checks
-
-<!-- Paste the summary lines. Fixture suites are not end-to-end installation
-tests; say so if a real installation was not performed. -->
-
-- `./tests/run`:
-- `python3 -B image/check-source`:
-- Manual verification (hardware, live shell, VM), or why it was not needed:
-
-## Dependencies and licensing
-
-- [ ] New downloads are pinned by version or commit and checksum ([dependency policy](https://github.com/DigitalPals/CybexOS/blob/main/docs/dependency-policy.md)), or none were added
-- [ ] New third-party code, artwork, fonts, or images have recorded provenance and a redistributable license ([licensing](https://github.com/DigitalPals/CybexOS/blob/main/docs/licensing.md)), or none were added
-
-## Privacy
-
-- [ ] No secrets, tokens, personal data, or unredacted logs in the diff, screenshots, or this description
+A fixture suite or Nix build is not end-to-end qualification. Product policy
+belongs in shared NixOS modules; never silently discard personal configuration
+to make an update pass.