Panama learns what a server is: from a root login to running containers

A machine's role is now the interview's first question and the one answer
Panama records. Servers get the same shell minus the screen: core packages,
nvm, Bun, Claude Code and Codex (desktops get Codex too), linger, rootless
ports from 80, firewalld, the nginx-bridge network, and a nightly image
updater that replaced watchtower for cause.

server/containers/ carries junior's 23 compose services -- secrets moved to
per-machine .env files that never enter this public repo, every transformed
compose proven to render byte-identical to what is live. 'panama server'
enables, disables and relinks them; nothing here restarts a running service.
'boot --server' walks a fresh VPS from its root login to a normal install.

Five new contracts pin the secrets rule, the catalog's shape, panama-server's
behavior, the role plumbing, and the dotfile classification.

Claude-Session: https://claude.ai/code/session_01NU5JGiN3JfzqrLQB6wmJ1E

setup/packages/core-packages

@@ -0,0 +1,37 @@
+# Every Panama machine, desktop or server. This is the shell environment
+# itself -- the tools config/bash/shell and the aliases assume -- plus the
+# few things both roles genuinely share. Desktop-only tools live in
+# initial-packages; server-only ones in server-packages.
+awk
+bat
+btop
+curl
+# `dnf copr`, which install-packages needs to enable the Hyprland COPR. A
+# machine that has used copr before has it; a fresh Workstation install does
+# not, and the failure would cost the entire desktop.
+dnf5-plugins
+eza
+fontconfig
+fzf
+gh
+git-all
+gum
+jq
+neovim
+# config/bash/shell initialises the prompt with this.
+oh-my-posh
+# ssh-keygen, which setup-identity uses to create a key on request.
+openssh
+openssl
+# Rootless containers: the compose services on a server, the speech-to-text
+# quadlet and the Containers settings page on a desktop.
+podman
+# What provides `podman compose` on Fedora; without it every unit's
+# ExecStart resolves to an error about a missing external provider.
+podman-compose
+python3-dnf
+ripgrep
+tmux
+unzip
+wget
+zoxide

setup/packages/development-packages

@@ -24,14 +24,11 @@ python3-questionary
 python3-pyperclip
 php
 php-fpm
-# Rootless containers, and the backend for the Containers settings page.
-podman
 python3-devel
 python3-gobject
 python3-tkinter
 python3-torch
 python3-virtualenv
-ripgrep
 ruby
 sqlite3
 # vimx: clipboard-capable vim, which the shipped `vim` alias and the vimrc

setup/packages/initial-packages

@@ -1,38 +1,15 @@
-awk
-bat
-btop
+# Desktop machines only. What every machine gets -- the shell environment
+# both roles share -- moved to core-packages; this is the remainder that only
+# makes sense with a screen, a session, or a person developing at it.
 cargo
-curl
-# `dnf copr`, which install-packages needs to enable the Hyprland COPR. A
-# machine that has used copr before has it; a fresh Workstation install does
-# not, and the failure would cost the entire desktop.
-dnf5-plugins
-eza
 # install-packages installs flatpaks with it; Fedora Workstation ships it,
 # but a minimal install does not.
 flatpak
-fontconfig
 fwupd
-fzf
-gh
-git-all
-gum
-jq
 kitty
 ksshaskpass
 libselinux-utils
-neovim
-# config/bash/shell initialises the prompt with this.
-oh-my-posh
-# ssh-keygen, which setup-identity uses to create a key on request.
-openssh
-openssl
 pciutils
-python3-dnf
 python3-neovim
 rustup
-tmux
-unzip
-wget
 wireguard-tools
-zoxide

setup/packages/server-packages

@@ -0,0 +1,13 @@
+# Only on role=server, on top of core-packages. Deliberately short: a server
+# is the shell environment plus containers, and almost everything it needs is
+# already core.
+#
+# setup-server opens 80/443/81 through it. Fedora Server ships it; a minimal
+# cloud image may not, and a server whose firewall step silently no-ops is a
+# server somebody believes is firewalled.
+firewalld
+# Node comes through nvm here for the same reason as on the desktop --
+# config/bash/shell switches versions per project from .nvmrc -- and because
+# install-packages puts Codex on with npm, agents' MCP servers want a node,
+# and a system nodejs earlier on PATH would win every switch.
+nvm