grdctl's interactive set-credentials reads from a controlling terminal, which a
systemd service does not have, so piping the username/password in set nothing
and GRD denied every client with 'Credentials are not set'. Pass them as
arguments instead.
New image built from upstream base-atomic (no desktop), adding only gnome-shell
+ gdm + gnome-remote-desktop + pipewire/portal + foot + Flatpak + Kanidm.
recommends=false to stay lean. Configures GNOME Remote Desktop headless remote
login on first boot (TLS + credentials + enable). Firefox preinstalled as a
per-user Flatpak. Add it to the CI matrix and prune both images.