feat: add optional no-SIP image variant to update-vm-tools workflow

[celanthe]

Summary

• Adds a noSip boolean input to the update-vm-tools workflow (default: false)
• When enabled, after the standard vm-tools update each image is booted in recovery mode using orka-engine vm run --recovery --vnc-port 5901
• A new VNC script (setup/vnc-disable-sip.py) navigates the Recovery UI to open Terminal, runs csrutil disable, and reboots
• The result is saved and pushed as <tag>-no-sip alongside the standard tag (e.g., sonoma:latest-no-sip)
• Cleanup handles the no-SIP VM separately so a failure in the no-SIP steps doesn't prevent the main VM from being cleaned up

Notes

• VNC connects to 127.0.0.1:5901 on the runner — the VNC server is hosted by orka-engine on the runner, not inside the VM, so it works in Recovery mode
• The vnc-disable-sip.py keyboard sequence uses Ctrl+F2 to focus the menu bar then navigates to Utilities > Terminal — this follows standard macOS accessibility behavior and may need timing adjustments after first test
• The no-SIP steps are opt-in and don't affect the standard workflow path

Test plan

• Trigger workflow with noSip: false — verify no-SIP steps are skipped
• Trigger workflow with noSip: true and images: sonoma — verify sonoma:latest-no-sip is pushed and csrutil status returns disabled
• Verify VNC keyboard sequence navigates Recovery UI correctly (may need timing tuning)

🤖 Generated with Claude Code

[spikeburton]

Can't test or merge this one until #30 is merged.

Sure you can.

The way to do this:

1. Branch off of your other branch, fix/workflow-image-filter-expression
2. Apply your changes from this branch there
3. Push changes and run workflow to test
4. Open this pull request against the branch fix/workflow-image-filter-expression, not main
5. Rebase this PR on main after the other has been merged

The other PR is approved, but just FYI for future, this should not be a blocker for testing changes. This is a common iterative approach

I will wait to review this one until after it has been tested btw. In the meantime, feel free to mark it as draft so we know it is still work in progress

[spikeburton]

Suggested change

	if: inputs.noSip == true
	if: ${{ inputs.noSip == true || inputs.noSip == 'true' }}

I would suggest checking against the string as well - when invoked via the gh CLI each input is parsed as a string, so the boolean condition will not succeed

[spikeburton]

Should we allow passing this to the script instead of hardcoding it? We pass the password, why not the username as well?

[celanthe]

Root cause identified: virtual kubelet is running on arm-mini-002.

vk manages all nodes in the cluster and deletes any VM it didn't schedule. When the workflow calls orka-engine vm run -d directly, vk sees an unknown VM and removes it — which is why orka-engine vm list returns [] immediately after. The vmnet/entitlement investigation in the previous version of this comment was the wrong path.

Blocked: orka3 vm deploy doesn't expose --recovery, so we can't route through the API for the no-SIP step. Waiting on Spike to confirm which node to target for image builds.

[spikeburton]

@celanthe is the virtual kubelet running on the node? It will delete VMs it does not know about

I would check this first before investigating anything else.