openwrt: Build fergal's firmware in the flake

fergal is an 8-port SFP+ switch on a Realtek RTL9303, running OpenWrt
rather than RouterOS or UniFi. It is not part of the fabric yet, but
its firmware is now built here via astro's nix-openwrt-imagebuilder.
Packages are baked into the image: OpenWrt's package server keeps only
the current build of each feed, so installing at runtime stops working
as soon as the feed moves past the running firmware.

Those feed indexes rotate constantly, and upstream pins only the
indexes -- a mismatch drops evaluation into import-from-derivation,
putting this flake's eval on the network. The openwrt-feeds input pins
expanded per-package hashes instead, in a repository of its own
because they run to hundreds of thousands of generated lines.

Flashing gets a procedure doc and a thin skill pointing at it, the
same split as the box installation and nixpkgs upgrade procedures.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

openwrt/default.nix

@@ -0,0 +1,32 @@
+{ pkgs, inputs }:
+# Firmware for the OpenWrt boxes. They are not NixOS and are not deployed by this flake - these
+# outputs only build a sysupgrade image, which is then flashed by hand (see the box's docs page).
+#
+# Baking packages into the image is the only reliable way to have them: OpenWrt's package server
+# keeps just the current build of each feed, so a box installing packages at runtime is broken as
+# soon as the feed moves on from the firmware it is running.
+let
+  inherit (inputs) openwrt-imagebuilder openwrt-feeds;
+
+  # Fallback to the release branch. Snapshot tracks OpenWrt main, which is where the rtl930x target
+  # is actually being developed; the release runs a much older kernel. Both are pinned by
+  # `openwrt-feeds`, so neither moves until that input is updated.
+  release = "25.12.5";
+
+  mkImage = args: openwrt-imagebuilder.lib.build (args // {
+    inherit pkgs;
+    cachePath = openwrt-feeds.cachePaths.${args.release};
+  });
+
+  # fergal, the 8-port SFP+ switch (XikeStor SKS8300-8X, board-branded ONTi ONT-S508CL-8S)
+  fergal = {
+    target = "realtek";
+    variant = "rtl930x";
+    profile = "xikestor_sks8300-8x";
+    packages = [ "luci" "ip-full" "ip-bridge" "ethtool-full" "luci-app-sfp-info" ];
+  };
+in
+{
+  openwrt-fergal = mkImage (fergal // { release = "snapshot"; });
+  openwrt-fergal-release = mkImage (fergal // { inherit release; });
+}