arch: make include/flatcar.yml the single source of truth for Flatcar pins

[kylerankin]

Makes include/flatcar.yml the single source of truth for every Flatcar upstream pin in the target release.

• Declares the Flatcar version, kernel vermagic, and the vmlinuz / container / ZFS source sha256s in one file.
• flatcar-kernel.bst and flatcar-zfs.bst read those pins via %{...} variable substitution instead of hard-coding refs.
• Adds .github/scripts/check-flatcar-version.py, a grep-based gate (in the spirit of check-release-version.py) that fails the build when any pinned literal appears outside the pin file, in elements/ or files/.
• Wires the gate into just validate.
• Adds unit tests for the checker and the live-tree invariant.

Acceptance:

• All Flatcar-derived versions resolve from include/flatcar.yml.
• A grep-based gate catches hardcoded versions in elements/ and files/.
• just validate python gates pass (release-version, k0s, flatcar).

Closes #137.

— hive: backend=pi model=lemonade/Ornith-1.5-35B-A3B-GGUF-Q6_K

🐝 Hive Agent: contributor | SHA: c6822b6

[castrojo]

Approving, after pushing a fix. This PR had the worst CI in the queue — build, build-kernel AND unit all failing, where all three pass on main — and it turned out to be one root cause, not three.

Root cause: invalid YAML. elements/flatcar/flatcar-kernel.bst and flatcar-zfs.bst declared refs as bare %{...} scalars:

ref: %{flatcar-kernel-vmlinuz-sha256}

% is a reserved YAML indicator and cannot begin a plain scalar, so every YAML consumer rejected the file. BuildStream's own loader died there, which is why build and build-kernel failed within seconds at "Validate Element Graph"; and tests/unit/test_build_depends.py yaml.safe_load()s every elements/**/*.bst, which is what turned it into the unit failure too. One character class, three red jobs.

Fix (commit 99eb2a8, 5886476..99eb2a8): quoted the three refs. Nothing else.

The design intent is preserved, which was the thing worth being careful about. The whole point of this PR is making include/flatcar.yml the single source of the Flatcar pins, and quoting does not break that — BuildStream expands %{...} inside source configs at load time, so ref: "%{flatcar-zfs-sha256}" still resolves from the include rather than becoming a literal. I checked that rather than assuming it: the build job now completes a full 41-minute compile with the quoted refs, which it could not do if the sha256 values were not resolving.

Verified green at the new head, re-checked myself rather than taken from the report: unit pass, build-kernel pass (24m58s), build pass (41m47s) — runs 35371680251, 35371680285, 35371681058. gh pr diff 143 --name-only lists exactly the PR's original six files, no strays from the concurrent work in this repo.

installer-test remains red, and that one is not this PR's: it fails on main itself at tip 5ebfeae (run 34920225526) because /var fails to mount and the box drops to emergency mode. #173 fixes that half, #181 the readiness-gate half.

On the direction. This is the right one, and it now agrees with where #136 ended up. include/flatcar.yml already declares itself "Single source of truth for Flatcar LTS kernel and sysext versioning", and the repo's established precedent is the k0s axis — include/k0s.yml is canonical and the pre-commit hook is literally named "k0s version derived from include/k0s.yml, not restated". #136 originally restated flatcar-version in project.conf; I have since fixed it to (@)-include include/flatcar.yml instead, so the two PRs no longer pull in opposite directions.

Merge-order note for whoever takes these: this PR edits include/flatcar.yml while #136 adds that file to project.conf's (@) include list. They do not conflict textually, but landing both means the variables this PR adds become visible project-wide through #136's include. That is the intended behaviour, just worth being deliberate about rather than discovering.

Approving. Needs one more independent approval under the two-reviewer policy, and merging should still wait for the /var fix so installer-test means something.

[kubestellar-hive]

Reviewed (correctness) — verified at head 99eb2a8: the checker passes on the live tree, all 10 unit tests pass, and no pin literal exists outside include/flatcar.yml in scanned dirs. One note:

• elements/flatcar/flatcar-kernel.bst:26,29 / flatcar-zfs.bst:21 — bst source track will write the resolved sha256 literal back into the .bst, clobbering %{...}. The new gate will then fail just validate, so drift is still prevented, but maintainers bumping Flatcar should update include/flatcar.yml by hand rather than tracking. Worth a line in the pin-file comment.

(Not verified: bst show resolution of %{} in ref fields — bst unavailable here; the existing %{flatcar-version} in the same sources' url fields is precedent for source-config substitution, and just validate's bst show steps cover it in CI.)

— hive: agent=reviewer backend=copilot model=claude-fable-5 copilot=1.0.78