packages: our kernel (7.4.0-rc1-1bit), amdxdna and ec_su_axb35 drivers as .deb/.rpm/Arch packages (DKMS), with the NPU config #1280

Owner 2026-11-06: "include all our kernel & driver packages now". This extends #1279: every distro package set also ships our own Linux kernel and drivers, the ones the 1bit OS stick runs, not only the user-space engine.

What we run (strixhalo and the c31 stick):

• Kernel 7.4.0-rc1-1bit. strixhalo has linux-image-7.4.0-rc1-1bit and linux-headers-7.4.0-rc1-1bit (7.4.0~rc1-1) installed as .debs, signed for Secure Boot with our MOK-Kernel key.
• amdxdna: our out-of-tree NPU driver, 0.18.0 at 526c6081 plus our patch series (the 0007-0011 series, the crash and resume fixes). Installed in /lib/modules/7.4.0-rc1-1bit/updates/. GPL.
• ec_su_axb35: the Bosgame AXB35 embedded-controller driver (fan curve). GPL.
• Runtime config these need: modules-load.d for ec_su_axb35, limits.d/99-amdnpu-memlock.conf (the NPU needs unlimited memlock), and the NPU keep-awake udev rule (90-1bit-npu-power.rules, the c30 614 fix).

Wanted, for the same families as #1279 (.deb for Ubuntu/Debian, .rpm for Fedora/openSUSE, Arch .pkg.tar.zst):

1. linux-image-1bit / linux-headers-1bit: the 7.4.0-rc1-1bit kernel. The .deb exists; add .rpm and Arch from the same config. Optional: a user who stays on their distro kernel doesn't need it.
2. amdxdna-1bit-dkms: our driver source plus patches as a DKMS package, so it builds against the user's own kernel (7.0+) as well as ours. Use the distro's DKMS module signing (the user's own MOK) for Secure Boot. It must replace the in-tree amdxdna cleanly (blacklist or updates/ precedence, the same as on strixhalo) and uninstall back to the in-tree one.
3. ec-su-axb35-dkms: same pattern. It loads only on AXB35 boards (DMI match), so it is harmless elsewhere.
4. 1bit-npu-config: the memlock limit, keep-awake udev rule and modules-load entries. Small, no binaries.
5. Secure Boot: the kernel package ships only our public MOK certificate plus a mokutil --import step in the docs, the way NVIDIA's packages do. The private key never leaves strixhalo and is never packaged, printed or committed. DKMS packages sign with the user's key.
6. GPL: each driver and kernel package ships, or links to, its exact source (the patch series included), with the same source offer as the 1bit OS release notes.
7. Proof per family: in a clean container, install, check that the DKMS build succeeds against the container's kernel headers, then uninstall. On strixhalo hardware, the .deb set installs and the NPU answers a known-answer probe through npu-hold.
8. docs/install-any-distro.md: replace "Do not install amdxdna-dkms from that archive" with our packages and when to use each. Keep the warning about AMD's archive package.

Lane: pi-kpkg, with pi-pkg (#1279, the engine packages) and pi-kernel-74 (the kernel and driver source, #1051).