Custom Bazzite DX NVIDIA (open) image: BlueBuild recipe, GHCR workflow, cosign setup

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

recipes/recipe.yml

@@ -0,0 +1,46 @@
+# yaml-language-server: $schema=https://schema.blue-build.org/recipe-v1.json
+# Custom desktop image: Bazzite DX (KDE) + NVIDIA open kernel modules (RTX 5090 / Blackwell).
+#
+# The base image already ships: Steam + gaming stack, Flatpak, Docker CE + CLI,
+# Podman, VS Code, Homebrew, the NVIDIA 610+ open driver, AND nvidia-container-toolkit
+# with automatic CDI generation (ublue-nvctk-cdi.service). Nothing GPU/dev-related
+# needs to be layered here — this recipe only adds signature-verification policy
+# and the declarative first-boot Flatpak set.
+name: main-desktop
+description: Bazzite DX NVIDIA (open, KDE) with my first-boot Flatpak set, signed.
+
+base-image: ghcr.io/ublue-os/bazzite-dx-nvidia
+# Pinned to Fedora 44. Bump deliberately (stable-45, ...) when ready to jump majors.
+image-version: stable-44
+
+modules:
+  - type: default-flatpaks
+    configurations:
+      - scope: system
+        notify: true
+        install:
+          # -- Official / verified Flathub listings --
+          - com.bambulab.BambuStudio
+          - com.bitwarden.desktop
+          - com.discordapp.Discord
+          - com.moonlight_stream.Moonlight
+          - dev.goats.xivlauncher
+          - fr.handbrake.ghb
+          - io.podman_desktop.PodmanDesktop
+          - net.pcsx2.PCSX2 # official PCSX2 build — do not swap for community forks
+          - net.wz2100.wz2100
+          - org.freecad.FreeCAD # current ID; old org.freecadweb.FreeCAD is dead
+          - org.gimp.GIMP
+          - org.libreoffice.LibreOffice
+          - org.mozilla.Thunderbird
+          - org.mozilla.firefox
+          # -- Community / unverified listings (see README) --
+          - com.makemkv.MakeMKV
+          - io.github.hmlendea.geforcenow-electron # unofficial wrapper; 16:9/21:9 streams only
+          - io.github.shiftey.Desktop # GitHub Desktop Linux fork; "shiftey" is correct
+          - org.godotengine.Godot
+          - org.videolan.VLC
+
+  # Installs the cosign public key + container signature-verification policy
+  # so `bootc`/`rpm-ostree` signed rebases work. Requires cosign.pub at repo root.
+  - type: signing