feat(kernel-sweep): support the RHEL family (dnf/grubby)

[ErenAri]

Why

kernel-sweep was Ubuntu-only, so RHEL-family profiles could never be credited by the family-aware freshness from #93 — there was no way to validate their newest kernel at all. They were the largest remaining block of genuinely-stale profiles.

What

Extends sweep to AlmaLinux, Rocky and CentOS Stream:

• RHELKernelRPMs derives the bootable kernel RPMs from the crawler entry. The crawler publishes only kernel-devel, from AppStream, while kernel-core and the modules packages live in BaseOS — so the component is swapped as well as the file name, inheriting mirror, repo version, arch, and any per-letter subdirectory (Rocky's Packages/k/).
• In-guest install is family-aware: dnf + grubby --set-default, which selects by vmlinuz path and avoids the grub menu-title matching Debian requires.
• KernelInstallFamily centralises distro → family for validation, install and sweep. Oracle (UEK ships from its own repos, not BaseOS), Amazon, and immutable image-based systems (RHCOS/FCOS/Flatcar/Bottlerocket/Talos) stay explicitly unsupported.
• Validation accepts .rpm for RHEL-family profiles and still rejects it for Debian ones.

Latent bug fixed

--target defaulted to ubuntu-generic, which is wrong for the -minimal profiles (they run ubuntu-kvm) — sweeping one would have generated profiles from the wrong kernel flavor. The crawler mapping now comes from vm/kernel-baselines.yaml for the base profile, including release_contains (which keeps el9 and el10 apart under one distro key). Flags still override.

Verification — real boots, not just URL checks

Profile	Kernel installed + booted
almalinux-9-5.14	5.14.0-687.26.1.el9_8
rocky-9-5.14	5.14.0-687.26.1.el9_8
centos-stream-9-5.14	5.14.0-725.el9

All three pass, kernels confirmed from in-guest uname -r. Unit tests cover both mirror layouts (AlmaLinux flat, Rocky letter-subdir) and the mismatched-release error path. Full suite, gofmt, golangci-lint, and profile-catalog validation all clean.

Effect

Freshness stale 6 → 3. The remaining three are not reachable by a base-image or sweep refresh: amazon-linux-2 (no browsable pool the crawler maps to), oracle-linux-9-uek7 (UEK own repos), rhel-8 (subscription-gated, no source_url).

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[ErenAri]

Security hardening (from automated review)

Pushed 2f9dc17 addressing findings on the kernel install path.

Transport. kernel-crawler publishes plain http mirror URLs and the derivations passed the scheme through, so a kernel being installed into the guest was modifiable in transit. Both derivations now emit https (verified that all five mirrors serve the same paths over TLS), and validKernelPackageURL now rejects any non-https entry so a hand-written or future profile cannot reintroduce plaintext. All previously generated sweep profiles regenerated; zero http:// remains in vm/profiles/ or matrices/.

Verification — the more serious one, which the review understated. The RHEL install used --nogpgcheck, disabling signature checks outright. That was mine, not inherited. It now runs rpm --checksig and installs with localpkg_gpgcheck=1. That flag is the point: dnf skips GPG verification for local package files unless it is set, so simply dropping --nogpgcheck would have looked fixed while verifying nothing. This is also stronger than the suggested sha256 digests — it chains to the distro signing keys rather than a digest we compute ourselves.

What enforcing it exposed. Real boots failed on two of three distros:

Distro	Before key import
AlmaLinux 9	pass
Rocky 9	digests SIGNATURES NOT OK
CentOS Stream 9	digests SIGNATURES NOT OK

The packages were fine — AlmaLinux pre-imports the distro keys into the rpm keyring, while Rocky and CentOS cloud images only place them on disk. The install now imports the keys shipped inside the vendor image before verifying (the same trust anchor dnf uses for that image's configured repos, so it does not weaken the check).

Re-validated on real boots after the change: almalinux-9, rocky-9, centos-stream-9 (signatures verified) and ubuntu-24.04 (https through the dpkg path) — all pass.

Known limit, stated plainly: the Debian path gets transport integrity only. dpkg -i cannot verify signatures on standalone .deb files — a dpkg limitation (apt verifies at the index level), not a configuration choice.