BC-250 console image: custom GNOME recipe with remote admin

Based on 62fixolab/Latest-Bazzite-AMD-BC-250-Patched-Images @ 347fd4d.

Adds on top of the fork:
- recipes/bc250-console-gnome.yml: governor + gnome-remote-desktop +
  openssh-server, sshd enabled, hhd.service masked, no signing module
  (local build + ISO path)
- files/console/usr/bin/bc250-remote-setup: one-time on-box SSH/RDP setup
- files/console/usr/lib/bootc/kargs.d/50-bc250-ttm.toml: ttm memory kargs
- BUILD-CONSOLE.md: build -> ISO -> validation instructions

files/console/ is separate from files/system/ so the 40-CU unlock tooling
stays out of this stable 24-CU image.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

files/console/usr/bin/bc250-remote-setup

@@ -0,0 +1,126 @@
+#!/usr/bin/env bash
+# bc250-remote-setup — one-time remote-admin setup for the BC-250 console.
+#
+# Run this from a terminal INSIDE the child's desktop session (not over SSH):
+# GNOME Remote Desktop is configured per-user and only serves while that
+# user's session is running. SSH works regardless of who is logged in.
+#
+# Sets up:
+#   * sshd enabled + firewall opened  (headless admin: updates, shell)
+#   * GNOME Remote Desktop over RDP with a self-signed TLS cert and
+#     credentials you choose  (drive the desktop to install games)
+#
+# Secrets (RDP password, TLS key) are created here on the box — they are
+# deliberately NOT part of the OS image.
+
+set -u
+
+bold()  { printf '\033[1m%s\033[0m\n' "$*"; }
+warn()  { printf '\033[33mWARNING:\033[0m %s\n' "$*"; }
+ok()    { printf '\033[32m  ok:\033[0m %s\n' "$*"; }
+
+if [ "$(id -u)" -eq 0 ]; then
+    warn "Run this as the regular desktop user, not root. Aborting."
+    exit 1
+fi
+
+FW_CHANGED=0
+
+# ---------------------------------------------------------------- SSH ------
+bold "[1/3] SSH (headless admin)"
+
+if systemctl is-enabled sshd.service >/dev/null 2>&1 && systemctl is-active sshd.service >/dev/null 2>&1; then
+    ok "sshd already enabled and running"
+else
+    sudo systemctl enable --now sshd.service && ok "sshd enabled + started" \
+        || warn "could not enable sshd — run 'sudo systemctl enable --now sshd' manually"
+fi
+
+if sudo firewall-cmd --permanent --query-service=ssh >/dev/null 2>&1; then
+    ok "firewall already allows ssh"
+else
+    sudo firewall-cmd --permanent --add-service=ssh >/dev/null && FW_CHANGED=1 && ok "firewall: ssh service allowed" \
+        || warn "could not open firewall for ssh"
+fi
+
+# ---------------------------------------------------- GNOME Remote Desktop -
+bold "[2/3] GNOME Remote Desktop (RDP)"
+
+if ! command -v grdctl >/dev/null 2>&1; then
+    warn "grdctl not found — skipping RDP setup (is gnome-remote-desktop installed?)"
+else
+    CERT_DIR="$HOME/.local/share/gnome-remote-desktop"
+    CERT="$CERT_DIR/rdp-tls.crt"
+    KEY="$CERT_DIR/rdp-tls.key"
+    mkdir -p "$CERT_DIR"
+
+    if [ -s "$CERT" ] && [ -s "$KEY" ]; then
+        ok "TLS cert already exists at $CERT_DIR"
+    else
+        openssl req -x509 -newkey rsa:4096 -nodes -days 3650 \
+            -subj "/CN=bc250-console" \
+            -keyout "$KEY" -out "$CERT" >/dev/null 2>&1 \
+            && chmod 600 "$KEY" && ok "self-signed TLS cert generated" \
+            || warn "openssl cert generation failed"
+    fi
+
+    printf 'RDP username to create: '
+    read -r RDP_USER
+    printf 'RDP password (input hidden): '
+    read -rs RDP_PASS
+    printf '\n'
+
+    grdctl rdp set-tls-cert "$CERT" 2>/dev/null || warn "grdctl set-tls-cert failed"
+    grdctl rdp set-tls-key  "$KEY"  2>/dev/null || warn "grdctl set-tls-key failed"
+
+    # Credential syntax varies across GNOME versions — try the two common
+    # forms, then fall back to telling the user to do it interactively.
+    if grdctl rdp set-credentials "$RDP_USER" "$RDP_PASS" 2>/dev/null; then
+        ok "RDP credentials stored"
+    elif printf '%s\n%s\n' "$RDP_USER" "$RDP_PASS" | grdctl rdp set-credentials 2>/dev/null; then
+        ok "RDP credentials stored (interactive form)"
+    else
+        warn "could not store credentials automatically — run 'grdctl rdp set-credentials' yourself"
+    fi
+    unset RDP_PASS
+
+    grdctl rdp enable 2>/dev/null || warn "grdctl rdp enable failed"
+
+    systemctl --user enable --now gnome-remote-desktop.service \
+        && ok "per-user gnome-remote-desktop.service enabled" \
+        || warn "could not enable gnome-remote-desktop.service for this user"
+
+    if sudo firewall-cmd --permanent --query-port=3389/tcp >/dev/null 2>&1; then
+        ok "firewall already allows 3389/tcp"
+    else
+        sudo firewall-cmd --permanent --add-port=3389/tcp >/dev/null && FW_CHANGED=1 && ok "firewall: 3389/tcp (RDP) allowed" \
+            || warn "could not open firewall for RDP"
+    fi
+fi
+
+# ------------------------------------------------------------- summary -----
+bold "[3/3] Finishing up"
+
+if [ "$FW_CHANGED" -eq 1 ]; then
+    sudo firewall-cmd --reload >/dev/null && ok "firewall reloaded" || warn "firewall reload failed"
+fi
+
+echo
+bold "This console's addresses:"
+ip -4 -o addr show scope global | awk '{ printf "  %-12s %s\n", $2, $4 }'
+if command -v tailscale >/dev/null 2>&1; then
+    TS_IP="$(tailscale ip -4 2>/dev/null | head -n1)"
+    if [ -n "${TS_IP:-}" ]; then
+        echo "  tailscale    $TS_IP"
+    else
+        echo "  (tailscale installed but not up — run: sudo tailscale up)"
+    fi
+fi
+
+echo
+bold "How to connect:"
+echo "  SSH:  ssh <your-user>@<address>          (works any time the box is on)"
+echo "  RDP:  any RDP client -> <address>:3389   (only while this desktop session"
+echo "        is logged in; use the RDP username/password you just set)"
+echo
+echo "Keep SSH/RDP LAN- or tailnet-only. Do NOT port-forward 22/3389 to the internet."

files/console/usr/lib/bootc/kargs.d/50-bc250-ttm.toml

@@ -0,0 +1,4 @@
+# BC-250: allow the GPU to use more than 8 GB of the 16 GB shared GDDR6.
+# 3959290 pages * 4 KiB ≈ 15.1 GiB ceiling for TTM allocations.
+# Harmless if Bazzite's hardware setup also applies these on first boot.
+kargs = ["ttm.pages_limit=3959290", "ttm.page_pool_size=3959290"]