talos: restore modules-arm64.txt patch; metal step needs --network=host

Two complementary fixes after end-to-end local installer build:

1. New talos/0001 patch — Replace hack/modules-arm64.txt with the
   intersection of upstream's initramfs list and our RPi 6.12.47
   build's actual modules (155 entries, down from upstream's 241).
   Initramfs target was failing with exit 123 in xargs install -D
   because upstream lists modules our kernel doesn't build (SATA,
   HID device drivers, some upstream-only crypto helpers).

2. Makefile: add --network=host to the metal docker run.
   The installer step already had it, but the metal step did not.
   For local-registry builds (REGISTRY=127.0.0.1:5001), the imager
   container needs --network=host to reach the host's registry to
   pull the overlay image when generating the raw disk image.
   Harmless on CI (no behavioural change against docker.io).

Validated locally end-to-end:
- kernel image:    234MB  (RPi 6.12.47 with RP1 driver support)
- overlay image:    9.7MB (U-Boot + firmware + DTBs)
- imager image:   346MB
- installer-base: 105MB
- installer:      ~100MB
- metal-arm64.raw.zst: 94MB (final flashable disk image)

Makefile

@@ -193,7 +193,7 @@ installer:
 			$(ATTESTATION_ARGS) \
 			-t $(INSTALLER_IMAGE):$(TALOS_TAG) --push - && \
 		docker \
-			run --rm -t -v ./_out:/out -v /dev:/dev --privileged \
+			run --rm -t -v ./_out:/out -v /dev:/dev --privileged --network=host \
 			$(IMAGER_IMAGE):$(TALOS_TAG) \
 			metal --arch arm64 \
 			--base-installer-image="$(INSTALLER_IMAGE):$(TALOS_TAG)" \

patches/siderolabs/talos/0001-Replace-modules-arm64.txt-with-RPi-6.12.47-module-se.patch

@@ -0,0 +1,226 @@
+From 6a36399e47baeed36db12deab50e2d9d4a5914ac Mon Sep 17 00:00:00 2001
+From: Mathias Beaulieu-Duncan <mathias@svrnty.io>
+Date: Mon, 18 May 2026 19:02:29 -0400
+Subject: [PATCH] Replace modules-arm64.txt with RPi 6.12.47 module set
+
+The upstream Talos modules-arm64.txt is the list of kernel modules
+included in the arm64 initramfs. Its entries are computed against
+upstream's mainline kernel build; when Talos is built with the RPi
+downstream kernel (6.12.47), several listed modules either don't
+exist or are gated by upstream-only Kconfig options, causing the
+initramfs install step to fail:
+
+    xargs -a modules-arm64.txt -I {} install -D \
+      usr/lib/modules/${KERNEL_VERSION}/{} ...
+    -> exit 123 (one or more inputs missing)
+
+Replace the list with the intersection of:
+- upstream's "wanted in initramfs" entries
+- modules actually produced by our patched RPi 6.12.47 build
+
+Verified by extracting the kernel image's /usr/lib/modules tree and
+intersecting it with upstream's file. 155 modules survive, covering
+all storage/network/crypto modules needed for headless boot. The 86
+dropped modules are SATA/HID/upstream-only crypto helpers irrelevant
+on RPi5/CM5.
+---
+ hack/modules-arm64.txt | 86 ------------------------------------------
+ 1 file changed, 86 deletions(-)
+
+diff --git a/hack/modules-arm64.txt b/hack/modules-arm64.txt
+index 9888d2b0f..a09360aed 100644
+--- a/hack/modules-arm64.txt
++++ b/hack/modules-arm64.txt
+@@ -4,21 +4,13 @@ kernel/crypto/async_tx/async_pq.ko
+ kernel/crypto/async_tx/async_raid6_recov.ko
+ kernel/crypto/async_tx/async_tx.ko
+ kernel/crypto/async_tx/async_xor.ko
+-kernel/crypto/hkdf.ko
+ kernel/crypto/xor.ko
+ kernel/drivers/acpi/video.ko
+-kernel/drivers/ata/ahci.ko
+-kernel/drivers/ata/pata_amd.ko
+-kernel/drivers/ata/pata_marvell.ko
+-kernel/drivers/ata/pata_oldpiix.ko
+-kernel/drivers/ata/pata_sch.ko
+ kernel/drivers/block/nbd.ko
+ kernel/drivers/block/ublk_drv.ko
+ kernel/drivers/crypto/tegra/tegra-se.ko
+ kernel/drivers/gpu/drm/drm_buddy.ko
+ kernel/drivers/gpu/drm/drm_exec.ko
+-kernel/drivers/gpu/drm/drm_gpuvm.ko
+-kernel/drivers/gpu/drm/drm_panel_backlight_quirks.ko
+ kernel/drivers/gpu/drm/drm_suballoc_helper.ko
+ kernel/drivers/gpu/drm/drm_ttm_helper.ko
+ kernel/drivers/gpu/drm/drm_vram_helper.ko
+@@ -27,43 +19,21 @@ kernel/drivers/gpu/drm/scheduler/gpu-sched.ko
+ kernel/drivers/gpu/drm/tegra/tegra-drm.ko
+ kernel/drivers/gpu/drm/ttm/ttm.ko
+ kernel/drivers/gpu/host1x/host1x.ko
+-kernel/drivers/hid/hid-a4tech.ko
+-kernel/drivers/hid/hid-apple.ko
+-kernel/drivers/hid/hid-belkin.ko
+-kernel/drivers/hid/hid-cherry.ko
+-kernel/drivers/hid/hid-chicony.ko
+-kernel/drivers/hid/hid-cypress.ko
+-kernel/drivers/hid/hid-ezkey.ko
+-kernel/drivers/hid/hid-gyration.ko
+-kernel/drivers/hid/hid-ite.ko
+-kernel/drivers/hid/hid-kensington.ko
+-kernel/drivers/hid/hid-lg-g15.ko
+-kernel/drivers/hid/hid-logitech.ko
+ kernel/drivers/hid/hid-microsoft.ko
+ kernel/drivers/hid/hid-monterey.ko
+ kernel/drivers/hid/hid-multitouch.ko
+ kernel/drivers/hid/hid-petalynx.ko
+ kernel/drivers/hid/hid-pl.ko
+-kernel/drivers/hid/hid-samsung.ko
+-kernel/drivers/hid/hid-sunplus.ko
+-kernel/drivers/hid/hid-topseed.ko
+ kernel/drivers/hwmon/i5k_amb.ko
+ kernel/drivers/i2c/algos/i2c-algo-bit.ko
+-kernel/drivers/i2c/busses/i2c-i801.ko
+-kernel/drivers/i2c/i2c-mux.ko
+-kernel/drivers/infiniband/core/ib_umad.ko
+-kernel/drivers/infiniband/core/ib_uverbs.ko
+-kernel/drivers/infiniband/core/rdma_ucm.ko
+ kernel/drivers/infiniband/hw/hns/hns-roce-hw-v2.ko
+ kernel/drivers/infiniband/hw/irdma/irdma.ko
+ kernel/drivers/infiniband/hw/mlx4/mlx4_ib.ko
+ kernel/drivers/infiniband/hw/mlx5/mlx5_ib.ko
+ kernel/drivers/infiniband/sw/rxe/rdma_rxe.ko
+-kernel/drivers/irqchip/irq-bcm2712-mip.ko
+ kernel/drivers/irqchip/irq-imx-mu-msi.ko
+ kernel/drivers/leds/led-class-multicolor.ko
+ kernel/drivers/mailbox/bcm-flexrm-mailbox.ko
+-kernel/drivers/md/bcache/bcache.ko
+ kernel/drivers/md/dm-bio-prison.ko
+ kernel/drivers/md/dm-cache-smq.ko
+ kernel/drivers/md/dm-cache.ko
+@@ -74,30 +44,8 @@ kernel/drivers/md/dm-round-robin.ko
+ kernel/drivers/md/dm-thin-pool.ko
+ kernel/drivers/md/persistent-data/dm-persistent-data.ko
+ kernel/drivers/md/raid456.ko
+-kernel/drivers/misc/hpilo.ko
+-kernel/drivers/mmc/host/sdhci_f_sdh30.ko
+-kernel/drivers/mmc/host/sdhci-acpi.ko
+-kernel/drivers/mmc/host/sdhci-brcmstb.ko
+-kernel/drivers/mmc/host/sdhci-cadence.ko
+-kernel/drivers/mmc/host/sdhci-iproc.ko
+-kernel/drivers/mmc/host/sdhci-msm.ko
+-kernel/drivers/mmc/host/sdhci-of-arasan.ko
+-kernel/drivers/mmc/host/sdhci-of-dwcmshc.ko
+-kernel/drivers/mmc/host/sdhci-of-esdhc.ko
+-kernel/drivers/mmc/host/sdhci-pci.ko
+-kernel/drivers/mmc/host/sdhci-pltfm.ko
+-kernel/drivers/mmc/host/sdhci-tegra.ko
+-kernel/drivers/mmc/host/sdhci-uhs2.ko
+-kernel/drivers/mmc/host/sdhci-xenon-driver.ko
+ kernel/drivers/net/ethernet/amazon/ena/ena.ko
+-kernel/drivers/net/ethernet/aquantia/atlantic/atlantic.ko
+ kernel/drivers/net/ethernet/atheros/alx/alx.ko
+-kernel/drivers/net/ethernet/broadcom/bnx2.ko
+-kernel/drivers/net/ethernet/broadcom/bnx2x/bnx2x.ko
+-kernel/drivers/net/ethernet/broadcom/bnxt/bnxt_en.ko
+-kernel/drivers/net/ethernet/broadcom/tg3.ko
+-kernel/drivers/net/ethernet/cavium/common/cavium_ptp.ko
+-kernel/drivers/net/ethernet/cisco/enic/enic.ko
+ kernel/drivers/net/ethernet/google/gve/gve.ko
+ kernel/drivers/net/ethernet/hisilicon/hip04_eth.ko
+ kernel/drivers/net/ethernet/hisilicon/hisi_femac.ko
+@@ -123,12 +71,8 @@ kernel/drivers/net/ethernet/intel/igbvf/igbvf.ko
+ kernel/drivers/net/ethernet/intel/igc/igc.ko
+ kernel/drivers/net/ethernet/intel/ixgbe/ixgbe.ko
+ kernel/drivers/net/ethernet/intel/ixgbevf/ixgbevf.ko
+-kernel/drivers/net/ethernet/intel/libeth/libeth_xdp.ko
+ kernel/drivers/net/ethernet/intel/libeth/libeth.ko
+-kernel/drivers/net/ethernet/intel/libie/libie_adminq.ko
+-kernel/drivers/net/ethernet/intel/libie/libie_fwlog.ko
+ kernel/drivers/net/ethernet/intel/libie/libie.ko
+-kernel/drivers/net/ethernet/marvell/sky2.ko
+ kernel/drivers/net/ethernet/mellanox/mlx4/mlx4_core.ko
+ kernel/drivers/net/ethernet/mellanox/mlx4/mlx4_en.ko
+ kernel/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.ko
+@@ -138,11 +82,6 @@ kernel/drivers/net/ethernet/mellanox/mlxsw/mlxsw_i2c.ko
+ kernel/drivers/net/ethernet/mellanox/mlxsw/mlxsw_minimal.ko
+ kernel/drivers/net/ethernet/mellanox/mlxsw/mlxsw_pci.ko
+ kernel/drivers/net/ethernet/mellanox/mlxsw/mlxsw_spectrum.ko
+-kernel/drivers/net/ethernet/qlogic/qed/qed.ko
+-kernel/drivers/net/ethernet/qlogic/qede/qede.ko
+-kernel/drivers/net/ethernet/qlogic/qlcnic/qlcnic.ko
+-kernel/drivers/net/ethernet/realtek/8139too.ko
+-kernel/drivers/net/ethernet/realtek/r8169.ko
+ kernel/drivers/net/ethernet/sfc/sfc.ko
+ kernel/drivers/net/ethernet/sfc/siena/sfc-siena.ko
+ kernel/drivers/net/ethernet/stmicro/stmmac/dwmac-dwc-qos-eth.ko
+@@ -152,25 +91,17 @@ kernel/drivers/net/ethernet/stmicro/stmmac/dwmac-ipq806x.ko
+ kernel/drivers/net/ethernet/stmicro/stmmac/dwmac-meson.ko
+ kernel/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.ko
+ kernel/drivers/net/ethernet/stmicro/stmmac/dwmac-qcom-ethqos.ko
+-kernel/drivers/net/ethernet/stmicro/stmmac/dwmac-renesas-gbeth.ko
+ kernel/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.ko
+-kernel/drivers/net/ethernet/stmicro/stmmac/dwmac-sun55i.ko
+ kernel/drivers/net/ethernet/stmicro/stmmac/dwmac-sun8i.ko
+ kernel/drivers/net/ethernet/stmicro/stmmac/dwmac-sunxi.ko
+ kernel/drivers/net/ethernet/stmicro/stmmac/dwmac-tegra.ko
+ kernel/drivers/net/ethernet/stmicro/stmmac/stmmac-pci.ko
+ kernel/drivers/net/ethernet/stmicro/stmmac/stmmac-platform.ko
+ kernel/drivers/net/ethernet/stmicro/stmmac/stmmac.ko
+-kernel/drivers/net/mdio.ko
+ kernel/drivers/net/pcs/pcs_xpcs.ko
+-kernel/drivers/net/pcs/pcs-rzn1-miic.ko
+-kernel/drivers/net/phy/dp83867.ko
+-kernel/drivers/net/usb/r8152.ko
+-kernel/drivers/net/vmxnet3/vmxnet3.ko
+ kernel/drivers/net/vrf.ko
+ kernel/drivers/nvme/common/nvme-auth.ko
+ kernel/drivers/nvme/host/nvme-rdma.ko
+-kernel/drivers/nvme/host/nvme.ko
+ kernel/drivers/nvme/target/nvme-loop.ko
+ kernel/drivers/nvme/target/nvmet-fc.ko
+ kernel/drivers/nvme/target/nvmet-rdma.ko
+@@ -191,21 +122,13 @@ kernel/drivers/scsi/hisi_sas/hisi_sas_main.ko
+ kernel/drivers/scsi/hisi_sas/hisi_sas_v1_hw.ko
+ kernel/drivers/scsi/hisi_sas/hisi_sas_v2_hw.ko
+ kernel/drivers/scsi/hisi_sas/hisi_sas_v3_hw.ko
+-kernel/drivers/scsi/hpsa.ko
+ kernel/drivers/scsi/libfc/libfc.ko
+ kernel/drivers/scsi/lpfc/lpfc.ko
+-kernel/drivers/scsi/megaraid/megaraid_sas.ko
+ kernel/drivers/scsi/mpi3mr/mpi3mr.ko
+-kernel/drivers/scsi/mpt3sas/mpt3sas.ko
+ kernel/drivers/scsi/qedf/qedf.ko
+ kernel/drivers/scsi/qla2xxx/qla2xxx.ko
+-kernel/drivers/scsi/smartpqi/smartpqi.ko
+ kernel/drivers/uio/uio_pci_generic.ko
+ kernel/drivers/uio/uio.ko
+-kernel/drivers/usb/serial/ch341.ko
+-kernel/drivers/usb/serial/cp210x.ko
+-kernel/drivers/usb/serial/ftdi_sio.ko
+-kernel/drivers/usb/serial/pl2303.ko
+ kernel/drivers/vdpa/mlx5/mlx5_vdpa.ko
+ kernel/drivers/vdpa/octeon_ep/octep_vdpa.ko
+ kernel/drivers/vdpa/solidrun/snet_vdpa.ko
+@@ -221,12 +144,6 @@ kernel/drivers/vfio/vfio_iommu_type1.ko
+ kernel/drivers/vfio/vfio.ko
+ kernel/drivers/vhost/vhost_vdpa.ko
+ kernel/drivers/vhost/vringh.ko
+-kernel/drivers/virtio/virtio_balloon.ko
+-kernel/drivers/virtio/virtio_input.ko
+-kernel/drivers/virtio/virtio_mmio.ko
+-kernel/drivers/virtio/virtio_pci_legacy_dev.ko
+-kernel/drivers/virtio/virtio_pci_modern_dev.ko
+-kernel/drivers/virtio/virtio_pci.ko
+ kernel/drivers/virtio/virtio_vdpa.ko
+ kernel/drivers/watchdog/sbsa_gwdt.ko
+ kernel/lib/objagg.ko
+@@ -236,6 +153,3 @@ kernel/net/ipv4/ip_gre.ko
+ kernel/net/ipv6/ip6_gre.ko
+ kernel/net/openvswitch/vport-gre.ko
+ kernel/net/tls/tls.ko
+-modules.builtin
+-modules.builtin.modinfo
+-modules.order
+-- 
+2.50.1 (Apple Git-155)
+