Fit the appliance under GitHub's 2 GiB release limit

The qcow2 is written with zstd and 2M clusters after trimming freed blocks,
and the appliance leaves out clang, llvm, the Docker plugins, lazydocker,
base-devel, aether, and yay, plus usr/share/doc through NoExtract: 2.78 GB
became 2.10 GB. sudo is installed explicitly now that base-devel no longer
pulls it in.

Claude-Session: https://claude.ai/code/session_019krxFwnSbEM2n2QNQ1rG1K

builder/build-utm.sh

@@ -180,6 +180,8 @@ version=$(arch-chroot "$TARGET" pacman -Q omarchy-dev | cut -d' ' -f2)
 : >"$TARGET/etc/machine-id"
 rm -f "$TARGET"/etc/ssh/ssh_host_* "$TARGET/root/.bash_history"
 rm -rf "$TARGET"/var/cache/pacman/pkg/*
+# Freed blocks still hold old bytes; trimming zeroes them so they compress to nothing.
+fstrim "$TARGET" && fstrim "$TARGET/boot"
 
 echo "==> Checking the sealed image"
 [[ ! -s $TARGET/etc/machine-id ]]
@@ -199,5 +201,5 @@ losetup -d "$loop"
 loop=""
 
 echo "==> Writing the compressed disk"
-qemu-img convert -c -O qcow2 "$IMAGE" "$OUT/omarchy-utm-se.qcow2"
+qemu-img convert -c -O qcow2 -o compression_type=zstd,cluster_size=2M "$IMAGE" "$OUT/omarchy-utm-se.qcow2"
 echo "$version" >"$OUT/omarchy-utm-se.version"

builder/pacman-utm-se.conf

@@ -6,6 +6,8 @@ CheckSpace
 ParallelDownloads = 5
 SigLevel = Required DatabaseOptional
 LocalFileSigLevel = Optional
+# Developer documentation does not fit a bundle that GitHub caps at 2 GiB.
+NoExtract = usr/share/doc/* usr/share/gtk-doc/*
 
 [core]
 Include = /etc/pacman.d/mirrorlist

builder/utm-se-drop.packages

@@ -1,9 +1,16 @@
-# Base packages the appliance leaves out: desktop apps too heavy for an interpreted guest, tools with no aarch64 build, and hardware-only helpers.
+# Base packages the appliance leaves out: apps and toolchains too heavy for an interpreted guest, tools with no aarch64 build, and helpers for hardware the guest has not.
+aether
 asdcontrol
+clang
+docker-buildx
+docker-compose
 gpu-screen-recorder
 hyprland-preview-share-picker
 kdenlive
+lazydocker
 libreoffice-fresh
+llvm
 localsend
 moonlight-qt
 xournalpp
+yay

builder/utm-se.packages

@@ -1,7 +1,6 @@
 # Installed before the Omarchy base set: the aarch64 kernel, keyrings, boot stack, guest tools, and the dev packages built from the utm-se checkout.
 archlinuxarm-keyring
 base
-base-devel
 efibootmgr
 limine
 linux-aarch64
@@ -15,4 +14,5 @@ pipewire
 qemu-guest-agent
 snapper
 spice-vdagent
+sudo
 zram-generator