fix(ollama): self-install upstream binary when no rpm exists

The previous 37-ollama-prep.sh bailed early on every CI build because
its 'command -v ollama' check assumed ollama was installed via
packages-ai -- but ollama is NOT a Fedora RPM. Visible symptom: the
build duration only grew ~36 seconds when 37-ollama-prep.sh re-entered
the main pipeline, instead of the multi-minute pull a real
qwen2.5-coder:7b download would take. The image shipped with no
build-baked models.

Fix: when 'command -v ollama' returns nothing, fetch the official
upstream tarball from github.com/ollama/ollama/releases/latest, pick
the right -amd64 / -arm64 asset by uname -m, extract the ELF, and
install it to /usr/bin/ollama (immutable composefs surface, FHS-
canonical for system binaries). Try .tgz first, fall back to .tar.zst
if upstream changes asset format. All failures fall through to
'skipping bake' rather than failing the build, so a transient network
issue doesn't block the rest of the pipeline.

PACKAGES.md gets a comment in the packages-ai block documenting why
ollama isn't listed there (no Fedora RPM upstream) and pointing at
the runtime path (docker.io/ollama/ollama image used by the
mios-ollama Quadlet).

After this lands, the build duration should grow by the time it
takes to pull the configured bake set
(MIOS_OLLAMA_BAKE_MODELS, default qwen2.5-coder:7b + nomic-embed-text
~5 GB). The seed lands at /usr/share/ollama/models on the immutable
surface, then mios-ollama-firstboot.service hardlink-copies it into
/var/lib/ollama/models on first deploy.

Author: Kabuki94

automation/37-ollama-prep.sh

@@ -43,12 +43,49 @@ if [[ -d "${BAKE_DIR}/manifests" ]] && [[ -n "$(ls -A "${BAKE_DIR}/manifests" 2>
     exit 0
 fi
 
-# ollama is installed as part of packages-ai (see usr/share/mios/PACKAGES.md).
-# If it's not on PATH the build context didn't include the AI pack -- skip
-# rather than fail so unrelated CI builds still pass.
+# ollama is NOT a Fedora RPM -- fetch the official upstream tarball
+# from github.com/ollama/ollama/releases when it isn't already on
+# PATH. The binary lands in /usr/bin/ollama (immutable composefs
+# surface, FHS-canonical for system binaries) and stays there in the
+# deployed image so the mios-ollama Quadlet's container can also exec
+# it via 'podman exec mios-ollama ollama ...' if needed.
 if ! command -v ollama >/dev/null 2>&1; then
-    log "ollama binary not found -- skipping bake (AI pack missing from this build)"
-    exit 0
+    log "ollama binary missing -- fetching upstream tarball"
+    arch="$(uname -m)"
+    case "$arch" in
+        x86_64)  ollama_arch="amd64"  ;;
+        aarch64) ollama_arch="arm64"  ;;
+        *)       log "Unsupported arch '$arch' for ollama upstream tarball -- skipping bake"; exit 0 ;;
+    esac
+    url="https://github.com/ollama/ollama/releases/latest/download/ollama-linux-${ollama_arch}.tgz"
+    tmp="$(mktemp -d /tmp/ollama-fetch.XXXXXX)"
+    trap 'rm -rf "$tmp"' EXIT
+    if ! command -v zstd >/dev/null 2>&1; then
+        # The .tgz upstream uses gzip, but newer releases ship .tar.zst.
+        # Pull zstd in case the asset shape changes -- 'dnf install' is
+        # only invoked when missing so this is a no-op on most builds.
+        $DNF_BIN "${DNF_SETOPT[@]}" install -y zstd >/dev/null 2>&1 || true
+    fi
+    if scurl -fsSL "$url" -o "$tmp/ollama.tgz"; then
+        # Try .tgz first; fall back to zst extraction if upstream changes.
+        if tar -xzf "$tmp/ollama.tgz" -C "$tmp" 2>/dev/null \
+           || tar --zstd -xf "$tmp/ollama.tgz" -C "$tmp" 2>/dev/null; then
+            bin="$(find "$tmp" -type f -name 'ollama' -perm -u+x | head -1)"
+            if [[ -n "$bin" ]] && file "$bin" 2>/dev/null | grep -q ELF; then
+                install -m 0755 -t /usr/bin/ "$bin"
+                log "Installed /usr/bin/ollama from upstream tarball"
+            else
+                log "Upstream tarball did not contain a usable ollama ELF -- skipping bake"
+                exit 0
+            fi
+        else
+            log "Failed to extract ollama tarball -- skipping bake"
+            exit 0
+        fi
+    else
+        log "Failed to download ${url} -- skipping bake"
+        exit 0
+    fi
 fi
 
 # Bake destination; OLLAMA_MODELS is the canonical override env var

usr/share/mios/PACKAGES.md

@@ -722,6 +722,16 @@ Rust-based LLM CLI agents and shell integrations.
 aichat
 aichat-ng
 ```
+<!--
+  ollama is NOT a Fedora RPM; it ships as a tarball from
+  https://github.com/ollama/ollama/releases and is fetched by
+  automation/37-ollama-prep.sh at build time. The runtime container
+  also has its own ollama binary baked into the docker.io/ollama/
+  ollama image used by the mios-ollama Quadlet -- both are
+  ARM/x86_64-multi-arch and share the same model store at
+  /usr/share/ollama/models (build-baked) and /var/lib/ollama/models
+  (runtime, hardlink-seeded by mios-ollama-firstboot.service).
+-->
 
 ## Internal -- Critical Validation