feat(image): flash full disk images into LUKS; add Raspberry Pi OS

Support distributions that ship a full .img (Raspberry Pi OS, moode, RetroPie,
Manjaro ARM) rather than a rootfs tarball, by loop-mounting the image and
copying its boot + root partitions into a fresh LUKS container.

- distributions.yml/catalog.py/choosers.py: raspios catalog (lite64/desktop64/
  lite32 via the stable _latest redirects) + choose_raspios.
- plan.py: source_url override so a _latest redirect downloads under an .img.xz
  name that decompress_command recognises.
- transfer.py: transfer_disk_image (loop-mount -> repartition -> LUKS -> rsync
  copy with progress, cp fallback -> fix boot fstab); transfer_image gains
  interactive= and routes encrypted non-arch images here; download_image gains
  force_prompt.
- loopimg.py: losetup attach/detach/partition helper.
- fsutil.drop_fstab_mount + register_encrypted_root: replace a stock image's
  existing / fstab line instead of colliding with it.
- encryption.configure_encryption returns the onion address.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

lim/image/encryption.py

@@ -13,7 +13,10 @@ from lim.image.plan import ImagePlan
 from lim.image.session import ImageSession, install_packages
 
 
-def configure_encryption(plan: ImagePlan, session: ImageSession, authorized_keys: Path) -> None:
+def configure_encryption(
+    plan: ImagePlan, session: ImageSession, authorized_keys: Path
+) -> str | None:
+    """Configure the remote-unlock LUKS stack; return the onion address, if any."""
     root = session.root_mount_path
     backend = get_backend(plan.distribution)
     ui.info("Setup encryption...")
@@ -26,12 +29,14 @@ def configure_encryption(plan: ImagePlan, session: ImageSession, authorized_keys
 
     backend.install_authorized_key(root, authorized_keys)
 
+    onion_address = None
     if plan.tor_unlock:
         # Hook files and onion keys must exist before the initramfs is baked.
-        backend.install_tor_unlock(plan, root)
+        onion_address = backend.install_tor_unlock(plan, root)
 
     # crypttab must be written before the initramfs is (re)generated so the
     # Debian cryptsetup hook can bake the mapping in.
     backend.register_encrypted_root(plan, session, root)
     backend.configure_initramfs(plan, root)
     backend.configure_bootloader(plan, session, root)
+    return onion_address