refactor(orch): render the distro selection in provision.sh's own template

[tomassrnka]

The follow-up promised in the #3411 review (@dobrac's three comments: Go templating for the selector, profiles-as-data with selection living in provision.sh, init blocks in separate files). #3459 has merged; this now sits directly on main.

What changed

• Structure vs data split: the selection block (case arms, rejected-id guard, ID_LIKE loop, all error/warning text) moved verbatim from the ShellSelector() string-builder into provision.sh as inline text/template actions. The distro package now contributes data only — distro.NewTemplateData() — with all shell-quoting kept in Go where it's unit-testable. No FuncMap (repo precedent).
• Init-setup blocks left their Go string literals for distro/init-{systemd,openrc,nixos}.sh, go:embed'd.
• Cache key: the selection structure is now covered by the raw embedded provision.sh that Hash() already hashes; distro.Fingerprint() covers the spliced data (%#v of the view — new fields fingerprint automatically). Version 1 → 2. The dev/fallback provision version rotates once on deploy; production rollout stays gated by the BuildProvisionVersion LD flag.
• Tests: selection-text assertions moved to base/provision_test.go against the fully rendered script (the render seam and tests are build-tag-free, so they run on darwin). Every prior assertion is preserved, including the errexit guard (no if e2b_select_profile) and guard-before-fallback ordering. New: per-field %q-vs-sh quoting pins, byte-exact customer-message pins, and a leftover-{{ render check.

Verification

• Rendered output diffed against the old ShellSelector(): byte-identical for the whole selection function; only deliberate comment/blank-line additions in the tail.
• Full e2e on an E2B Local dev slot (cold cache, orchestrator rebuilt from this branch): oraclelinux:9 rejected with byte-identical ERROR lines; kali builds with the byte-identical ID_LIKE WARNING and boots; alpine (OpenRC path) builds and boots with envd healthy; ubuntu and debian build and boot. sh -n clean on the rendered script.

Rebase onto current main (#3478, #3440)

Both landed after the last rebase and both touch the code this PR moves, so the merge was semantic, not textual:

• fix(orch): choose the chrony time source at boot instead of at build time #3440 added the chrony-source wiring to the very initSetup literals this PR deletes — the systemd $E2B_TIMESYNC_UNIT.service.d drop-in, OpenRC's e2b-chrony-source install, and the unconditional command_args="-F 0". All three are now in init-openrc.sh / init-systemd.sh, verified byte-for-byte against main's literals. fix(orch): choose the chrony time source at boot instead of at build time #3440's provision_test.go and its three distro_test.go tests are kept; the chrony-deferral test now reads the rendered script, since the init blocks no longer live in the raw template.
• fix(orch): pin nixpkgs to a supported release for the NixOS base image #3478's InitBinary: "/sbin/e2b-nixos-init" survives the distro.go rewrite and reaches the rendered arm as E2B_INIT_BIN="/sbin/e2b-nixos-init".

Tree swept for orphans of the moved code — E2B_CHRONY_PHC, command_args="-F 0", e2b-chrony-source, E2B_TIMESYNC_UNIT, E2B_INIT_BIN, /sbin/e2b-nixos-init, ShellSelector, DistroSelector: every consumer has a definition, no definition is stranded.

New test pinning the restored invariant: TestProvisionScriptSplicesEveryProfileField asserts every ProfileView field — including the init-setup body now sourced from a file — reaches its rendered case arm. A dropped template action would otherwise leave the Go-side tests over Profiles/initSetup green while the guest hits an undefined variable under set -eu, on every distro. It subsumes the old TestProvisionScriptInitSetup, which is removed.

Re-verified after the rebase: rendered script byte-identical to main's ShellSelector() output apart from the comments; sh -n, bash -n and shellcheck -s sh clean on the three new files and on the rendered script.

🤖 Generated with Claude Code

[cursor]

PR Summary

Medium Risk
Changes the contract for every template base build and rotates cache keys; intended behavior is unchanged but a template wiring or quoting mistake would break provisioning across distros.

Overview
Distro profile selection for base-image provisioning is no longer built as a Go string (ShellSelector); it is rendered inside provision.sh via text/template, fed by distro.NewTemplateData() with quoting and init-setup bodies prepared in Go (init blocks moved to embedded init-*.sh files). Base-layer cache fingerprinting now hashes that view data and bumps distro Version to 2, while script shape stays in the existing provision script hash. Tests that asserted on generated selector text now render the full script in provision_test.go (including on darwin).

^{Reviewed by Cursor Bugbot for commit 5b134af. Bugbot is set up for automated code reviews on this repo. Configure here.}

[codecov]

Codecov Report

❌ Patch coverage is 82.92683% with 7 lines in your changes missing coverage. Please review.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
...chestrator/pkg/template/build/phases/base/files.go	0.00%	4 Missing ⚠️
...pkg/template/build/phases/base/provision_script.go	66.66%	2 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!