fix(build): remove artifact dep from build, make ai-bootstrap fail-soft

artifact (AI manifest generation) was a hard dependency of the build
recipe and tried to write automation/manifest.json as root when the repo
is mounted at /. Removing it from build deps — it is optional dev tooling,
not an OCI build gate. Dropping -e from ai-bootstrap.sh and wrapping each
python3 call in || true so a single permission error never blocks the build.

Also fixes wsl-firstboot default password: when no MIOS_USER_PASSWORD_HASH
is supplied, falls back to generating the sha512crypt hash of 'mios' via
openssl passwd -6 rather than leaving the account locked.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: Kabuki94

Justfile

@@ -46,7 +46,7 @@ lint:
     podman run --rm --entrypoint /usr/bin/bootc {{LOCAL}} container lint
 
 # Build OCI image locally
-build: artifact preflight flight-status
+build: preflight flight-status
     podman build --no-cache \
         --build-arg BASE_IMAGE={{env_var_or_default("MIOS_BASE_IMAGE", "ghcr.io/ublue-os/ucore-hci:stable-nvidia")}} \
         --build-arg MIOS_FLATPAKS={{env_var_or_default("MIOS_FLATPAKS", "")}} \

automation/ai-bootstrap.sh

@@ -3,7 +3,7 @@
 # rebuilds the unified knowledge base (RAG snapshot), refreshes user-space
 # environment configs, and seeds shared agent context. Idempotent.
 
-set -euo pipefail
+set -uo pipefail
 
 echo "[ai-bootstrap] Initializing MiOS agent workspace..."
 
@@ -20,24 +20,24 @@ fi
 # 1. Generate manifests.
 if [[ -f "tools/generate-ai-manifest.py" ]]; then
     echo "[ai-bootstrap] Generating directory manifests..."
-    python3 tools/generate-ai-manifest.py
+    python3 tools/generate-ai-manifest.py || echo "[ai-bootstrap] WARN: manifest generation failed (non-fatal)"
 else
     echo "[ai-bootstrap] WARN: tools/generate-ai-manifest.py not found"
 fi
 
 # 2. Sync Wiki documentation.
 if [[ -f "tools/sync-wiki.py" ]]; then
     echo "[ai-bootstrap] Syncing Wiki..."
-    python3 tools/sync-wiki.py
+    python3 tools/sync-wiki.py || echo "[ai-bootstrap] WARN: wiki sync failed (non-fatal)"
 else
     echo "[ai-bootstrap] WARN: tools/sync-wiki.py not found"
 fi
 
 # 3. Generate unified knowledge base (RAG snapshot).
 if [[ -f "tools/generate-unified-knowledge.py" ]]; then
     echo "[ai-bootstrap] Generating unified knowledge base (RAG snapshot)..."
-    [[ -f "tools/journal-sync.py" ]] && python3 tools/journal-sync.py
-    python3 tools/generate-unified-knowledge.py
+    [[ -f "tools/journal-sync.py" ]] && { python3 tools/journal-sync.py || true; }
+    python3 tools/generate-unified-knowledge.py || echo "[ai-bootstrap] WARN: knowledge base generation failed (non-fatal)"
 else
     echo "[ai-bootstrap] WARN: tools/generate-unified-knowledge.py not found"
 fi

usr/libexec/mios/wsl-firstboot

@@ -57,7 +57,12 @@ if id "$MIOS_USER" &>/dev/null; then
     passwd -u "$MIOS_USER" 2>/dev/null || true
 fi
 
-# ── Password hash ──
+# ── Password hash (default: 'mios' if none supplied) ──
+if [[ -z "$MIOS_USER_HASH" ]] && id "$MIOS_USER" &>/dev/null; then
+    _log "No password hash supplied — generating default hash for password 'mios'"
+    MIOS_USER_HASH=$(openssl passwd -6 'mios' 2>/dev/null) || true
+fi
+
 if [[ -n "$MIOS_USER_HASH" ]] && id "$MIOS_USER" &>/dev/null; then
     if [[ "$MIOS_USER_HASH" =~ ^\$6\$ ]]; then
         _log "Setting password hash for $MIOS_USER"
@@ -66,7 +71,7 @@ if [[ -n "$MIOS_USER_HASH" ]] && id "$MIOS_USER" &>/dev/null; then
         _log "WARN: MIOS_USER_PASSWORD_HASH is not a valid sha512crypt hash (must start with \$6\$)"
     fi
 else
-    _log "WARN: No password hash found — $MIOS_USER will require password reset"
+    _log "WARN: Could not set password for $MIOS_USER — manual reset required"
 fi
 
 # ── Tmpfiles for /var/lib/mios ──