Add hash for Veiled Viper release

[MorningLightMountain713]

Summary

• Adds ArcaneOS image hash for the Veiled Viper release

Key fixes in this release

TPM 2.0 pcrlock compatibility (revision < 1.38)

Nodes running older TPM 2.0 hardware (revision 1.16) do not support the PolicyAuthorizeNV command required by systemd-pcrlock. This caused:

• systemd-pcrlock-make-policy and systemd-pcrlock-firmware-code services failing on every boot
• The upgrade process failing when attempting pcrlock policy updates

Fix: Added a lazy TPM compatibility check (_ensure_checked()) to all pcrlock operations in the updater — incompatible TPMs now gracefully skip pcrlock. Added ExecCondition drop-in overrides for both systemd pcrlock services using a flux-tpm-pcrlock-capable script that checks TPM revision >= 1.38.

VMware Xorg video driver segfault

Mesa upstream dropped the XA state tracker (libxatracker), so xserver-xorg-video-vmware in Ubuntu 25.10 (Questing) is compiled without KMS/3D support. On VMware SVGA II hardware, the driver falls back to legacy VGA register I/O and segfaults in vgaHWSaveColormap, crashing the flux-config-tui service.

Fix: Removed xserver-xorg-video-vmware from the image and explicitly installed all other video drivers (so they're marked manual and won't be auto-removed). The modesetting driver (built into xorg-server-core) handles VMware SVGA II via the kernel vmwgfx DRM driver.

Test plan

• Verified full upgrade cycle on TPM 1.16 nodes (62.107.25.214)
• Confirmed pcrlock services skip cleanly via ExecCondition
• Confirmed flux-config-tui runs on modesetting driver without crash
• Verified shutdown scripts, npm rebuild (Node 22→24), and POST_UPGRADE all succeed
• Zero failed services after upgrade

🤖 Generated with Claude Code

[Cabecinha84]

ack