Switch from systemd-networkd to NetworkManager, add AGENTS.md

- Replace systemd-networkd/resolved symlinks with NetworkManager
- Remove unused networkd config files (ethernet, wlan, wwan)
- Add AGENTS.md for CI/agent guidance
- Update motd and packages.x86_64

AGENTS.md

@@ -0,0 +1,55 @@
+# AGENTS.md
+
+Arch Linux ISO profile (archiso). Builds a live ISO with Hyprland desktop, end-4 dots-hyprland, and curated packages. Hosted on Gitea.
+
+## Build & Test Commands
+
+```bash
+# Build the ISO (repo root IS the profile directory)
+sudo mkarchiso -v -w work -o out/ .
+
+# Build AUR deps for end-4 (run locally before ISO build if localrepo/ is stale)
+./localrepo/build-end4-deps.sh          # build all
+./localrepo/build-end4-deps.sh --quick  # skip large AUR pkgs
+
+# Refresh localrepo DB after adding/moving .pkg.tar.zst files
+./localrepo/update.sh                    # re-indexes existing packages
+./localrepo/update.sh pkg1.pkg.tar.zst   # add files, then re-index
+```
+
+## CI Checks (must pass before merge)
+
+- **ShellCheck**: all `.sh` files checked with `shellcheck -x -s bash`
+- **yamllint**: all `.yml`/`.yaml` files (relaxed config)
+- **packages.x86_64 syntax**: one package per line, no trailing whitespace, `[a-zA-Z0-9._@+\-]+` only
+- **Package repo check**: every package in `packages.x86_64` must be resolvable via `pacman -Si` in allowed repos (`cachyos`, `extra`, `multilib`, `chaotic-aur`), OR have a pre-built `.pkg.tar.zst` in `localrepo/`, OR appear in `localrepo/build-end4-deps.sh`
+
+## Package Management
+
+**Three sources** contribute packages to the ISO:
+
+1. **`packages.x86_64`** — main list, installed by mkarchiso. Must be in an allowed repo.
+2. **`localrepo/*.pkg.tar.zst`** — pre-built AUR packages. The `local-aur` repo is configured in `pacman.conf` and picked up by mkarchiso automatically.
+3. **`build-end4-deps.sh`** — builds end-4 AUR deps at build time.
+
+**Important**: `localrepo/update.sh` auto-appends new package names to `packages.x86_64`. If you remove a package from `packages.x86_64` that exists in `localrepo/`, it will be re-added on the next `update.sh` run.
+
+## Key Files
+
+| File | Purpose |
+|------|---------|
+| `packages.x86_64` | Live ISO package list (~402 packages) |
+| `profiledef.sh` | ISO metadata, compression, boot modes |
+| `pacman.conf` | Repos: cachyos → core → extra → multilib → chaotic-aur → local-aur |
+| `bootstrap_packages` | Minimal build-time packages (`base`, `arch-install-scripts`) |
+| `airootfs/root/customize_airootfs.sh` | Runs inside chroot during build: keyrings, oh-my-zsh, lazy.nvim, plugins |
+| `localrepo/build-end4-deps.sh` | Non-interactive AUR builds for end-4 dependencies |
+| `localrepo/update.sh` | Regenerates localrepo DB + syncs names to packages.x86_64 |
+
+## Gotchas
+
+- The profile root is the **repo root** (not a `releng/` subdirectory). The CI build-iso workflow uses `mkarchiso -v -w work -o out/ releng` but this is a naming convention — the actual profile files live at the repo root.
+- `customize_airootfs.sh` clones git repos (oh-my-zsh, lazy.nvim, plugins) into `/etc/skel` during the ISO build. These require network access at build time but make the live ISO work offline.
+- The `[local-aur]` repo path in `pacman.conf` (`file:///home/alvin/alvinarch/localrepo`) is for local builds only. The CI does not use this path.
+- End-4 metapackages are built from `localrepo/end4-pkgbuilds/` (quickshell-git, bibata-modern-classic-bin, microtex-git).
+- `packages.x86_64` is sorted alphabetically. Keep it sorted when adding/removing entries.

airootfs/etc/motd

@@ -1,7 +1,7 @@
 To install Arch Linux follow the installation guide:
 https://wiki.archlinux.org/title/Installation_guide
 
-For Wi-Fi, authenticate to the wireless network using the iwctl utility.
+For Wi-Fi, run nmtui to configure a wireless network.
 For mobile broadband (WWAN) modems, connect with the mmcli utility.
 Ethernet, WLAN and WWAN interfaces using DHCP should work automatically.
 

airootfs/etc/systemd/network/20-ethernet.network

@@ -1,22 +0,0 @@
-[Match]
-Type=ether
-# Exclude virtual Ethernet interfaces
-Kind=!*
-
-[Link]
-RequiredForOnline=routable
-
-[Network]
-DHCP=yes
-MulticastDNS=yes
-
-# systemd-networkd does not set per-interface-type default route metrics
-# https://github.com/systemd/systemd/issues/17698
-# Explicitly set route metric, so that Ethernet is preferred over Wi-Fi and Wi-Fi is preferred over mobile broadband.
-# Use values from NetworkManager. From nm_device_get_route_metric_default in
-# https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/blob/main/src/core/devices/nm-device.c
-[DHCPv4]
-RouteMetric=100
-
-[IPv6AcceptRA]
-RouteMetric=100

airootfs/etc/systemd/network/20-wlan.network

@@ -1,20 +0,0 @@
-[Match]
-Type=wlan
-
-[Link]
-RequiredForOnline=routable
-
-[Network]
-DHCP=yes
-MulticastDNS=yes
-
-# systemd-networkd does not set per-interface-type default route metrics
-# https://github.com/systemd/systemd/issues/17698
-# Explicitly set route metric, so that Ethernet is preferred over Wi-Fi and Wi-Fi is preferred over mobile broadband.
-# Use values from NetworkManager. From nm_device_get_route_metric_default in
-# https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/blob/main/src/core/devices/nm-device.c
-[DHCPv4]
-RouteMetric=600
-
-[IPv6AcceptRA]
-RouteMetric=600

airootfs/etc/systemd/network/20-wwan.network

@@ -1,19 +0,0 @@
-[Match]
-Type=wwan
-
-[Link]
-RequiredForOnline=routable
-
-[Network]
-DHCP=yes
-
-# systemd-networkd does not set per-interface-type default route metrics
-# https://github.com/systemd/systemd/issues/17698
-# Explicitly set route metric, so that Ethernet is preferred over Wi-Fi and Wi-Fi is preferred over mobile broadband.
-# Use values from NetworkManager. From nm_device_get_route_metric_default in
-# https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/blob/main/src/core/devices/nm-device.c
-[DHCPv4]
-RouteMetric=700
-
-[IPv6AcceptRA]
-RouteMetric=700

airootfs/etc/systemd/system/multi-user.target.wants/NetworkManager.service

@@ -0,0 +1,30 @@
+[Unit]
+Description=Network Manager
+Documentation=man:NetworkManager.conf(5)
+Wants=NetworkManager-wait-online.service
+After=sysinit.target network-pre.target
+Wants=network-pre.target
+Before=network-online.target remote-fs.target
+After=network-pre.target
+BindsTo=sys-subsystem-net-devices.target
+After=sys-subsystem-net-devices.target
+
+[Service]
+Type=dbus
+BusName=org.freedesktop.NetworkManager
+ExecCondition=/usr/bin/test -x /usr/bin/NetworkManager
+ExecReload=/usr/bin/kill -HUP $MAINPID
+ExecStart=/usr/bin/NetworkManager --no-daemon
+Restart=on-failure
+KillMode=process
+CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_SYS_PTRACE CAP_DAC_READ_SEARCH CAP_DAC_OVERRIDE
+LockPersonality=yes
+MemoryDenyWriteExecute=yes
+ProtectHome=yes
+ProtectSystem=yes
+RestrictNamespaces=yes
+RestrictRealtime=yes
+SystemCallFilter=@system-service
+
+[Install]
+WantedBy=multi-user.target

airootfs/etc/systemd/system/multi-user.target.wants/systemd-networkd.service

@@ -1 +0,0 @@
-/usr/lib/systemd/system/systemd-networkd.service

airootfs/etc/systemd/system/multi-user.target.wants/systemd-resolved.service

@@ -1 +0,0 @@
-/usr/lib/systemd/system/systemd-resolved.service

packages.x86_64

@@ -220,6 +220,7 @@ neofetch
 neovim
 net-tools
 network-manager-applet
+networkmanager
 nfs-utils
 nikto
 nilfs-utils