feat(ssot): mios.toml [packages].sections + [packages.dev_overlay] -- consolidate user-defined section selection

Adds the missing piece that lets the dotfiles SSOT actually drive the
RPM install. Previously the dev overlay blanket-installed every fenced
```packages-<cat>``` block in PACKAGES.md (minus a hardcoded skip
list) -- which pulled in the full GNOME desktop, GDM, Phosh, gaming,
etc. on a podman-backend dev VM that doesn't host its own session.

[packages]
  sections = [...]   sections to install on a deployed MiOS host
                     (image-time, used by Containerfile +
                     automation/build.sh in a follow-up).

[packages.dev_overlay]
  sections = [...]   subset for the Windows-side MiOS-DEV podman
                     backend. NO gnome / phosh / gaming / android /
                     looking-glass-build / nut / freeipa / ha / ceph
                     -- the dev VM is a podman backend, not a
                     workstation. GUIs run as Flatpaks (Ptyxis,
                     Bazaar, Nautilus, Flatseal) routed through WSLg.
                     KEEPS gpu-* (CDI plumbing for /dev/dxg),
                     virt/storage/cockpit/build-toolchain, etc.

Always-skipped (regardless of selection): kernel, boot, moby, bloat,
critical -- WSL-incompatible or anti-pattern fence sections.

Mirrors the existing [desktop].flatpaks pattern: configurator HTML
edits the array, the build pipeline + dev overlay consume it. One
config touchpoint per Architectural Law 5 (UNIFIED-AI-REDIRECTS:
single SSOT, single resolver, single editor).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: Kabuki94

usr/share/mios/mios.toml

@@ -189,6 +189,50 @@ name      = "ghcr.io/mios-dev/mios"
 tag       = "latest"
 local_tag = "localhost/mios:latest"
 
+# ----------------------------------------------------------------------------
+# [packages] -- SSOT mapping mios.toml -> usr/share/mios/PACKAGES.md sections.
+# Operators tick / untick sections in the configurator HTML; the build
+# (Containerfile + automation/build.sh) and the MiOS-DEV live overlay
+# (Invoke-MiosOverlaySeed in mios-bootstrap/build-mios.ps1) both consume
+# this list instead of iterating every fenced ```packages-<cat>``` block.
+#
+#   sections        sections to install on a deployed MiOS host (image-time).
+#   dev_overlay     subset to install on the Windows-side MiOS-DEV podman
+#                   backend. Empty/unset = use a minimal sane default
+#                   (no GNOME shell, no Phosh, no gaming -- the dev VM is
+#                   a podman backend, not a desktop session; operators see
+#                   GUIs via flatpak windows routed through WSLg, e.g.
+#                   org.gnome.Ptyxis terminal).
+#
+# Always-skipped (regardless of selection): kernel, boot, moby, bloat,
+# critical -- these are either WSL-incompatible or anti-pattern fence
+# sections.
+# ----------------------------------------------------------------------------
+[packages]
+sections = [
+    "base", "security", "utils", "build-toolchain", "containers",
+    "cockpit", "storage", "virt", "guests",
+    "gpu-mesa", "gpu-nvidia", "gpu-amd-compute", "gpu-intel-compute",
+    "gnome", "phosh",
+    "ai", "k3s", "k3s-selinux-build", "cockpit-plugins-build",
+    "sbom-tools", "uki", "self-build", "network-discovery", "updater",
+    "wintools", "gaming", "nut", "ceph", "freeipa", "ha",
+    "looking-glass-build", "android",
+]
+
+[packages.dev_overlay]
+# MiOS-DEV (podman-WSL2 backend on Windows) minimal-but-complete:
+# every operator/dev/security daemon + the GPU CDI plumbing for /dev/dxg,
+# but NO desktop session (gnome/phosh) -- Ptyxis/Bazaar/Nautilus run as
+# Flatpaks routed through WSLg, the dev VM doesn't host its own session.
+sections = [
+    "base", "security", "utils", "build-toolchain", "containers",
+    "cockpit", "storage", "virt",
+    "gpu-mesa", "gpu-nvidia", "gpu-amd-compute", "gpu-intel-compute",
+    "ai", "sbom-tools", "self-build", "network-discovery", "updater",
+    "cockpit-plugins-build", "k3s-selinux-build", "uki",
+]
+
 # ----------------------------------------------------------------------------
 # [bootstrap] -- behavior of mios-bootstrap.git/install.sh during Phase-0.
 #   mode: auto | bootc | fhs