BC-250 console image: custom GNOME recipe with remote admin

Based on 62fixolab/Latest-Bazzite-AMD-BC-250-Patched-Images @ 347fd4d.

Adds on top of the fork:
- recipes/bc250-console-gnome.yml: governor + gnome-remote-desktop +
  openssh-server, sshd enabled, hhd.service masked, no signing module
  (local build + ISO path)
- files/console/usr/bin/bc250-remote-setup: one-time on-box SSH/RDP setup
- files/console/usr/lib/bootc/kargs.d/50-bc250-ttm.toml: ttm memory kargs
- BUILD-CONSOLE.md: build -> ISO -> validation instructions

files/console/ is separate from files/system/ so the 40-CU unlock tooling
stays out of this stable 24-CU image.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

BUILD-CONSOLE.md

@@ -0,0 +1,77 @@
+# BC-250 Console — local build → ISO
+
+Custom recipe: `recipes/bc250-console-gnome.yml` (Bazzite GNOME + cyan-skillfish
+governor + SSH/RDP remote admin + BC-250 ttm kargs). Build path is **local**
+(no CI, no registry, no cosign needed).
+
+## 1. Build the OCI image (any Fedora/bootc box, VM OK)
+
+```bash
+# prereqs: podman + bluebuild CLI
+sudo dnf install -y podman
+# bluebuild CLI: https://blue-build.org/how-to/setup/#installation
+podman run --rm ghcr.io/blue-build/cli --version   # or install natively
+
+bluebuild build ./recipes/bc250-console-gnome.yml
+```
+
+Result lands in local podman storage as `localhost/bc250-console-gnome`.
+
+### Kernel sanity check (before making the ISO)
+
+Avoid kernels 6.15.0–6.15.6 and 6.17.8–6.17.10; prefer 6.18.x LTS or 6.17.11+.
+The kernel comes from the Bazzite `stable` base — verify what you got:
+
+```bash
+podman run --rm localhost/bc250-console-gnome:latest rpm -q kernel
+```
+
+If it lands in a bad range, wait for the next Bazzite stable or pin an older
+`image-version` in the recipe.
+
+## 2. Generate the installer ISO
+
+```bash
+mkdir -p output
+sudo podman run --rm -it --privileged \
+  --security-opt label=type:unconfined_t \
+  -v ./output:/output \
+  -v /var/lib/containers/storage:/var/lib/containers/storage \
+  quay.io/centos-bootc/bootc-image-builder:latest \
+  --type iso \
+  localhost/bc250-console-gnome:latest
+```
+
+ISO appears under `output/bootiso/`.
+
+## 3. Smoke test + install
+
+1. **VM test**: boot the ISO in a VM, install, reach GNOME. This validates
+   composition/installer only — not the BC-250 GPU/governor/Mesa path.
+2. Flash to USB (Fedora Media Writer / Impression / `dd`), install on the
+   board. Black screen at install → "Install in Basic Graphics Mode".
+3. First boot, in the child's desktop session: run `bc250-remote-setup`,
+   log into Steam, set Steam Family View, `sudo tailscale up` if using it.
+
+## 4. On-hardware validation (board, not VM)
+
+```bash
+vulkaninfo | grep deviceName            # RADV GFX1013, NOT llvmpipe
+systemctl status cyan-skillfish-governor-smu   # active
+cat /sys/class/drm/card0/device/pp_dpm_sclk    # scaling present (may be card1)
+sensors                                  # sane temps; watch backplate airflow
+cat /proc/cmdline | tr ' ' '\n' | grep ttm     # ttm.pages_limit / page_pool_size
+```
+
+Then a real game for 30+ minutes for thermal/power stability.
+
+## Not baked into the image (per-board/per-user)
+
+Modded BIOS + BIOS settings (512 MB dynamic VRAM, IOMMU off, auto power-on),
+RDP password/TLS cert, Steam login, Tailscale auth.
+
+## Security
+
+- SSH/RDP LAN- or tailnet-only. Never port-forward 22/3389.
+- If this ever moves to a registry (Gitea) for OTA updates: generate your own
+  cosign keypair, re-add the `signing` module, and never reuse upstream's key.