`build.sh pi-image --target=rpi5 --profile=tv`: reproducible SD/NVMe image (FAT32 boot with DTBs + config + A/B kernel slots, root A/B partitions, data partition), first-boot provisioning (grow data, hostname, settings)

Epic: #113 · Milestone: MC9 — Ship

Why

cmd_pi_image today writes a Linux cmdline.txt and a /bin/sh script as /sbin/init, then touches an empty kernel image when none exists. Users need a single .img to flash with dd/Raspberry Pi Imager and a first boot that "just works".

Tasks

• Layout: p1 boot FAT32 512 MB (config.txt, bcm2712*.dtb, kernel_2712.img → symlink-free A/B via os_prefix/[tryboot] sections in config.txt — the Pi 5 bootloader supports tryboot for fallback), p2 rootA ext2/homefs, p3 rootB, p4 data (library, cache, settings) grown to disk size at first boot.
• Root contents: init, the TV shell, fonts, icons atlas, web remote assets, root CA bundle, default settings, licences (firmware blob licences kept separate and shown in About).
• Image assembly with host tools only (mkfs-free: our own tools/mkext2.py exists; FAT32 writer needed — small Python or Home host tool), deterministic (SOURCE_DATE_EPOCH), checksummed, ≤ 256 MB compressed.
• First boot: detect unprovisioned data partition → format/grow, generate hostname (homeos-tv-<serial4>), machine ID, start onboarding.
• docs/INSTALL_RPI5.md rewritten to the measured reality (banner removed only when the HIL install test passes).

Acceptance

build.sh pi-image --target=rpi5 --profile=tv on the Mac and in CI yields identical images; flashing + first boot on the rig reaches onboarding (capture) in ≤ 60 s including provisioning.

Size: M · Depends on: #54, #66, #92 · Blocks: #109, #111 (install test)