nix: add runner images outputs

nix/modules/ec-runner.nix

@@ -0,0 +1,28 @@
+{ lib, config, pkgs, self, ... }:
+
+let
+  cfg = config.services.every-channel.runner;
+in
+{
+  options.services.every-channel.runner = {
+    enable = lib.mkEnableOption "every.channel runner base system profile";
+  };
+
+  config = lib.mkIf cfg.enable {
+    # Minimal, conservative baseline for headless runners.
+    networking.useDHCP = lib.mkDefault true;
+    services.openssh.enable = lib.mkDefault true;
+
+    # Keep Nix flakes available on the runner itself.
+    nix.settings.experimental-features = lib.mkDefault [ "nix-command" "flakes" ];
+
+    # Provide the flake source tree at a stable path (symlink into /nix/store).
+    environment.etc."every-channel/flake".source = self;
+
+    environment.systemPackages = with pkgs; [
+      git
+      jq
+      curl
+    ];
+  };
+}

nix/nixos/ec-runner.nix

@@ -0,0 +1,29 @@
+{ lib, pkgs, ... }:
+
+{
+  imports = [
+    ../modules/ec-node.nix
+    ../modules/ec-runner.nix
+  ];
+
+  services.every-channel.runner.enable = true;
+
+  # This is a role image; avoid baking per-host secrets/keys. SSH host keys will be
+  # generated at first boot by NixOS defaults.
+  networking.hostName = lib.mkDefault "ec-runner";
+
+  time.timeZone = lib.mkDefault "UTC";
+
+  # Basic hygiene for unattended boxes.
+  services.openssh.settings.PasswordAuthentication = false;
+  services.openssh.settings.KbdInteractiveAuthentication = false;
+
+  # Enable serial console logs where possible (helps in headless bring-up).
+  boot.kernelParams = [
+    "console=tty0"
+  ];
+
+  # Required by NixOS.
+  system.stateVersion = "24.11";
+}
+