A card from CI, for bring-up

Every push to main that touches provisioning/ builds the card with the same make image-system you would run. CI boots it under QEMU, requires a copy with one byte changed to be refused, and keeps the card for 14 days as nullroute-card-UNSIGNED-<commit>. No Docker needed.

$ gh run list --workflow card --branch main --status success --limit 1
$ gh run download <run id> --dir card
$ cd card/nullroute-card-UNSIGNED-*
$ sha256sum -c SHA256SUMS

You get nullroute.img, its dm-verity root-hash and the QEMU boot log. Flash nullroute.img as in Flashing it.

UNSIGNED is the point of the name. Only CI built it. It answers "does this boot on my board" and nothing about whether it is the card it should be. For that, build it yourself and check with make image-repro.