fix(bundle): Carry hvi 0.1.0-rc.2

DESIGN.md

@@ -33,7 +33,7 @@ now done and is what `install.sh` and `scripts/build-bundle.sh` produce.
   fetches nothing else. Because the config files carry the fixed layout, the paths
   above are not configurable at install time.
 - **Why urunc is built (at release).** Most components are upstream release
-  artifacts, hvi among them (`brig-sh/hvi-vmm` `v0.1.0-rc.1`, cosign-verified).
+  artifacts, hvi among them (`brig-sh/hvi-vmm` `v0.1.0-rc.2`, cosign-verified).
   urunc has no release that carries what brig needs, so the build compiles it
   from `urunc-dev/urunc` at commit `3c00b69`, on `feat/linux-hvi-v050` (CGO
   static, so native per arch under qemu/binfmt). The source is pinned to a

README.md

@@ -283,7 +283,7 @@ urunc, which has none:
 | --- | --- | --- |
 | brig, brigd, brig-broker | `brig-sh/brig` release | fetched, verified against its signed `checksums.txt` |
 | urunc, containerd-shim-urunc-v2 | built from `urunc-dev/urunc` at commit `3c00b69` (branch `feat/linux-hvi-v050`) | CGO-static, built in a Go container |
-| hvi | `brig-sh/hvi-vmm` release `v0.1.0-rc.1` (commit `65570c7`), the one hull ships on macOS | fetched, musl-static; its `SHA256SUMS` cosign-verified against hvi-vmm's release workflow, the tarball pinned by sha256 |
+| hvi | `brig-sh/hvi-vmm` release `v0.1.0-rc.2` (commit `2ed8f61`), the one hull ships on macOS | fetched, musl-static; its `SHA256SUMS` cosign-verified against hvi-vmm's release workflow, the tarball pinned by sha256 |
 | guest kernel, container-initrd | `ghcr.io/nofireai/hull-assets` `0.1.11` | fetched by digest once its cosign signature checks out; the initrd is urunit. urunc's `packaging/container-initrd/urunit.pin` names `48a61bd`; hull-assets `0.1.11` does not record its urunit, so the bundle records that commit as `urunit_expected`. The build refuses a hull-assets bundle built from another urunc |
 | monitors, virtiofsd | `urunc-dev/monitors-build` | fetched, pinned by sha256 |
 | containerd, runc, nerdctl, CNI | upstream releases | fetched, upstream checksums |

docs/variants.md

@@ -166,7 +166,7 @@ refuses a stock binary, rather than printing a table of zeroes.
    from that urunc. urunc is pinned to a commit because a branch tip moves with
    every push; the README's build section says how to move it.
 4. Settled: `build-bundle.sh` fetches hvi from the `brig-sh/hvi-vmm` release
-   hull ships on macOS (`v0.1.0-rc.1`). `scripts/fetch-hvi.sh` checks the
+   hull ships on macOS (`v0.1.0-rc.2`). `scripts/fetch-hvi.sh` checks the
    cosign signature on its `SHA256SUMS`, the pinned sha256 of the tarball and
    the commit its manifest names.
 5. Is `introspection` a variant at all, or `generic-boot` plus an opt-in flag?

scripts/build-bundle.sh

@@ -134,10 +134,10 @@ URUNC_GO_IMAGE="${URUNC_GO_IMAGE:-golang:1.26.8}"
 # brig-sh/hvi-vmm release hull ships on macOS, static against musl. The tag,
 # its commit and the sha256 of each tarball describe one release, so a bump
 # changes all four together. scripts/fetch-hvi.sh checks them.
-HVI_VERSION=0.1.0-rc.1
-HVI_COMMIT=65570c78e6830ec6166fd5f9079998a47535b09f
-HVI_SHA256_LINUX_AMD64=1fc870d4946c08a576fe775b631ed225dc5687611f73c118b14b19dd75469853
-HVI_SHA256_LINUX_ARM64=277c0cfbd9a669f79e9819b35b327a9d815128e181215fa46618acca05bf9acc
+HVI_VERSION=0.1.0-rc.2
+HVI_COMMIT=2ed8f61dde8c20facd5f1a3668b170b07fb0eee1
+HVI_SHA256_LINUX_AMD64=e62358d9abcf2c8999227ef7ba16c25b57e131467eb4df916bffb68578b9ff25
+HVI_SHA256_LINUX_ARM64=3c11e3b1443fb9e39a652a0011ac74d548a7bd05674b6c4115ffbd5a0260e903
 # A branch given without a ref would otherwise build the pinned commit and
 # ignore the branch, so ask which one was meant.
 if [ -n "${URUNC_BRANCH:-}" ] && [ "$URUNC_BRANCH" != "$URUNC_BRANCH_DEFAULT" ] && [ -z "${URUNC_REF+set}" ]; then