overlay: opt-in build-time preprocessing of overlay files

[mobileoverlord]

Summary

Adds opt-in {{ … }} preprocessing of overlay file contents at build time,
so values (e.g. a secret such as an API/claim token) can be templated into
overlay files without mutating the working tree.

Usage

overlay:
  dir: overlay
  preprocess:                 # opt-in; default off = byte-identical to today
    - "etc/some/config.toml"  # globs, or `preprocess: true` for all UTF-8 files

The committed overlay file holds e.g. token = "{{ env.SOME_TOKEN }}"; the
value is substituted only into the built image, never back into the tree.

Details

• Reuses the existing env. / config. / avocado. interpolation engine via a
  new preprocess_text (no new templating language).
• Overlay files are copied verbatim inside the SDK container, so a processed
  copy is materialized on the host into .avocado/overlay-staging/<label>/
  (gitignored scratch, inside the /opt/src bind mount) and the copy is pointed
  there.
• Binary (non-UTF-8) files pass through verbatim; symlinks and mode bits are
  preserved.
• Wired into the rootfs/initramfs and sysext/confext overlay copy sites. Local
  overlays only; remote-extension overlays warn + skip.
• Stamps fold a post-preprocess content digest into the rootfs/initramfs/ext
  input hashes when preprocessing is enabled, so a changed template value or an
  edited overlay file invalidates the build. Verbatim overlays are unchanged.

Testing

• Unit tests for preprocess_text, glob matching, binary passthrough, and stamp
  invalidation on a changed template value.
• cargo build, cargo test, and cargo clippy are green.

[Copilot]

Pull request overview

Adds an opt-in build-time preprocessing path for overlay file contents (using the existing {{ ... }} interpolation engine) by materializing a staged overlay tree under .avocado/overlay-staging/, and updates stamp hashing so preprocessed overlay content changes can invalidate builds.

Changes:

• Introduces host-side overlay preprocessing/materialization and a deterministic post-preprocess overlay content digest.
• Wires preprocessing into rootfs/initramfs overlay application and local extension overlay builds (remote extensions warn + skip).
• Extends stamp input hashing to optionally fold in the post-preprocess overlay content digest (plus tests for invalidation behavior).

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
src/utils/stamps.rs	Folds a post-preprocess overlay content digest into stamp hash data when preprocessing is enabled; adds tests.
src/utils/overlay_preprocess.rs	New module implementing preprocessing selection, glob matching, digesting, and host-side staging of overlays.
src/utils/mod.rs	Exposes the new overlay_preprocess module.
src/utils/interpolation/mod.rs	Adds preprocess_text to reuse the interpolation engine for arbitrary file contents.
src/commands/rootfs/install.rs	Materializes a staged overlay (when opted-in) before applying overlay in the container.
src/commands/ext/build.rs	Adds preprocessing to extension overlay config and stages local overlays before in-container copy.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.