Disk image: update from the forge, not localhost/

bootc follows the image name a disk is built from, and the disk image
was built from localhost/quine-linux, so installs of it could never
update. Build it from forge.../quine-linux:latest (UPDATE_IMAGE), the
same image the live ISO's installs follow; Aurora's uupd.timer then
stages updates daily. bootc-image-builder's --target-imgref would do
this, but image-builder's version dropped it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Taskfile.yml

@@ -8,6 +8,10 @@ vars:
   # Override with a local build of the fork (BASE_IMAGE=localhost/aurora:stable,
   # see README) or stock upstream (BASE_IMAGE=ghcr.io/ublue-os/aurora:stable).
   BASE_IMAGE: forge.quinefoundation.com/quine-global-labs/aurora:stable
+  # Where installed systems get their updates: the disk image and the live
+  # ISO's installs point bootc here, and Aurora's uupd.timer stages whatever
+  # is newest there daily, for the next boot. iso.yml pushes it.
+  UPDATE_IMAGE: forge.quinefoundation.com/quine-global-labs/quine-linux:latest
   OUTPUT_DIR: '{{.ROOT_DIR}}/output'
   # Root is needed for the container builds and bootc; skip {{.SUDO}} when already
   # root (e.g. on a CI runner, which may not have {{.SUDO}} at all).
@@ -76,6 +80,14 @@ tasks:
       - task: build-image
       - task: export-to-storage
         vars: { IMAGES: "{{.IMAGE}}" }
+      # bootc follows the name the disk is built from, so build it from
+      # UPDATE_IMAGE's, not localhost/: installs then update from the forge.
+      # (bootc-image-builder's --target-imgref did this; image-builder
+      # dropped it.)
+      - >-
+        {{if eq .CONTAINER_RUNTIME "podman"}}{{.SUDO}} podman tag localhost/{{.IMAGE}} {{.UPDATE_IMAGE}}{{else}}{{.SUDO}} {{.CONTAINER_RUNTIME}} run --rm --privileged
+        -v {{.STORAGE}}:/var/lib/containers/storage {{.SKOPEO_IMAGE}}
+        copy containers-storage:localhost/{{.IMAGE}}:latest containers-storage:{{.UPDATE_IMAGE}}{{end}}
       - mkdir -p {{.OUTPUT_DIR}}
       # Root on btrfs, as Aurora installs it: disk/config.toml.
       - >-
@@ -86,7 +98,7 @@ tasks:
         -v {{.STORAGE}}:/var/lib/containers/storage
         {{.BIB_IMAGE}}
         --type qcow2
-        localhost/{{.IMAGE}}
+        {{.UPDATE_IMAGE}}
     generates:
       - "{{.OUTPUT_DIR}}/qcow2/disk.qcow2"
 
@@ -96,7 +108,7 @@ tasks:
       plus the live session and Anaconda WebUI, with PAYLOAD_IMAGE (what the
       installer installs) pulled into it. Podman only.
     vars:
-      PAYLOAD_IMAGE: '{{.PAYLOAD_IMAGE | default "forge.quinefoundation.com/quine-global-labs/quine-linux:latest"}}'
+      PAYLOAD_IMAGE: '{{.PAYLOAD_IMAGE | default .UPDATE_IMAGE}}'
     preconditions:
       - sh: '[ "{{.CONTAINER_RUNTIME}}" = podman ]'
         msg: The live ISO tasks need podman (they mount the image into Titanoboa's container).