refactor!: port shell scripts to Python package

Bash scripts were untestable and duplicated device/LUKS/mount logic;
the lim/ package centralizes it behind one subprocess wrapper and a
YAML image catalog (single point of truth).

BREAKING CHANGE: scripts/*.sh removed. Use `lim --type <cmd>`; new
types mount/umount/single-boot/raid1-boot/lock/unlock/import/export
replace direct script calls. --extra is deprecated and ignored.

- distributions.yml + lim/catalog.py hold the image catalog (PyYAML)
- pytest suite: 102 tests with mocked subprocess (tests/unit) and a
  250-line max file-length guard (tests/lint)
- ruff strict (select ALL), GitHub Actions CI, Dependabot; Travis gone
- Makefile: install (symlink ~/.local/bin/lim) and test targets
- fixes over bash: SUDO_USER-aware chown, mmcblk/nvme partition paths,
  sha512 checksum support, whole-pipeline failure detection, blkid
  UUID fallback for pre-mounted images, conditional fstab seeding for
  PARTUUID/LABEL images, clean errors for missing binaries

lim/storage/common.py

@@ -0,0 +1,38 @@
+"""Shared path derivation for encrypted storage setups."""
+
+from dataclasses import dataclass
+
+from lim import device as device_module
+from lim import ui
+from lim.device import Device
+
+
+@dataclass(frozen=True)
+class StorageTarget:
+    """An encrypted drive plus all derived mapper/mount/partition paths."""
+
+    device: Device
+
+    @property
+    def mapper_name(self) -> str:
+        return f"encrypteddrive-{self.device.name}"
+
+    @property
+    def mapper_path(self) -> str:
+        return f"/dev/mapper/{self.mapper_name}"
+
+    @property
+    def mount_path(self) -> str:
+        return f"/media/{self.mapper_name}"
+
+    @property
+    def partition_path(self) -> str:
+        return self.device.partition(1)
+
+
+def select_storage_target() -> StorageTarget:
+    target = StorageTarget(device_module.select_device())
+    ui.info(f"mapper name set to : {target.mapper_name}")
+    ui.info(f"mapper path set to : {target.mapper_path}")
+    ui.info(f"mount path set to : {target.mount_path}")
+    return target

lim/storage/raid1.py

@@ -0,0 +1,68 @@
+"""Encrypted Btrfs RAID1 across two drives.
+
+See https://balaskas.gr/btrfs/raid1.html and
+https://mutschler.eu/linux/install-guides/ubuntu-btrfs-raid1/
+"""
+
+from lim import luks, runner, ui
+from lim.storage.common import StorageTarget, select_storage_target
+
+
+def _select_pair() -> tuple[StorageTarget, StorageTarget]:
+    ui.info("RAID1 partition 1...")
+    first = select_storage_target()
+    ui.info("RAID1 partition 2...")
+    second = select_storage_target()
+    return first, second
+
+
+def setup() -> None:
+    first, second = _select_pair()
+
+    ui.info(f"Encrypting {first.device.path}...")
+    runner.run(["cryptsetup", "luksFormat", first.device.path], sudo=True)
+    ui.info(f"Encrypting {second.device.path}...")
+    runner.run(["cryptsetup", "luksFormat", second.device.path], sudo=True)
+
+    runner.run(["cryptsetup", "luksOpen", first.device.path, first.mapper_name], sudo=True)
+    runner.run(
+        ["cryptsetup", "luksOpen", second.device.path, second.mapper_name], sudo=True
+    )
+    runner.run(["cryptsetup", "status", first.mapper_path], sudo=True)
+    runner.run(["cryptsetup", "status", second.mapper_path], sudo=True)
+
+    runner.run(
+        [
+            "mkfs.btrfs",
+            "-m",
+            "raid1",
+            "-d",
+            "raid1",
+            first.mapper_path,
+            second.mapper_path,
+        ],
+        sudo=True,
+    )
+
+    ui.success("Encryption successfull :)")
+
+
+def _show_luks_devices() -> None:
+    for name in runner.output(["lsblk", "-dno", "NAME"], check=False).split():
+        if runner.succeeds(["cryptsetup", "isLuks", f"/dev/{name}"], sudo=True):
+            ui.info(f"/dev/{name} is a LUKS encrypted storage device.")
+
+
+def mount_on_boot() -> None:
+    ui.info("Activate Automount raid1 encrypted storages...")
+    _show_luks_devices()
+
+    first, second = _select_pair()
+
+    luks.create_luks_key_and_update_crypttab(first.mapper_name, first.device.path)
+    ui.info(f'Creating mount folder under "{first.mount_path}"...')
+    runner.run(["mkdir", "-vp", first.mount_path], sudo=True)
+    luks.create_luks_key_and_update_crypttab(second.mapper_name, second.device.path)
+    luks.update_fstab(first.mapper_path, first.mount_path)
+
+    ui.success("Installation finished. Please restart :)")

lim/storage/single_drive.py

@@ -0,0 +1,88 @@
+"""Single-drive LUKS + Btrfs storage: setup, mount, umount, mount-on-boot."""
+
+from lim import device as device_module
+from lim import luks, runner, system, ui
+from lim.storage.common import select_storage_target
+
+# fdisk answer sequences; empty lines accept the defaults.
+CREATE_GPT_TABLE_INPUT = "g\nw\n"
+CREATE_PARTITION_INPUT = "n\n\n\n\np\nw\n"
+
+
+def setup() -> None:
+    print("Setups disk encryption")
+    target = select_storage_target()
+
+    device_module.overwrite_device(target.device)
+
+    ui.info("Creating new GPT partition table...")
+    runner.run(
+        ["fdisk", "--wipe", "always", target.device.path],
+        input_text=CREATE_GPT_TABLE_INPUT,
+        sudo=True,
+    )
+    ui.info("Creating partition table...")
+    runner.run(
+        ["fdisk", "--wipe", "always", target.device.path],
+        input_text=CREATE_PARTITION_INPUT,
+        sudo=True,
+    )
+
+    ui.info(f"Encrypt {target.device.path}...")
+    runner.run(["cryptsetup", "-v", "-y", "luksFormat", target.partition_path], sudo=True)
+
+    ui.info("Unlock partition...")
+    runner.run(
+        ["cryptsetup", "luksOpen", target.partition_path, target.mapper_name], sudo=True
+    )
+
+    ui.info("Create btrfs file system...")
+    runner.run(["mkfs.btrfs", target.mapper_path], sudo=True)
+
+    ui.info(f'Creating mount folder under "{target.mount_path}"...')
+    runner.run(["mkdir", "-p", target.mount_path], sudo=True)
+
+    ui.info("Mount partition...")
+    runner.run(["mount", target.mapper_path, target.mount_path], sudo=True)
+
+    user = system.real_user()
+    ui.info("Own partition by user...")
+    runner.run(["chown", "-R", f"{user}:{user}", target.mount_path], sudo=True)
+
+    ui.success("Encryption successfull :)")
+
+
+def mount() -> None:
+    print("Mounts encrypted storages")
+    target = select_storage_target()
+
+    ui.info("Unlock partition...")
+    runner.run(
+        ["cryptsetup", "luksOpen", target.partition_path, target.mapper_name], sudo=True
+    )
+
+    ui.info("Mount partition...")
+    runner.run(["mount", target.mapper_path, target.mount_path], sudo=True)
+
+    ui.success("Mounting successfull :)")
+
+
+def umount() -> None:
+    print("Unmount encrypted storages")
+    target = select_storage_target()
+
+    ui.info(f"Unmount {target.mapper_path}...")
+    runner.run(["umount", target.mapper_path], sudo=True)
+    runner.run(["cryptsetup", "luksClose", target.mapper_name], sudo=True)
+
+    ui.success("Successfull :)")
+
+
+def mount_on_boot() -> None:
+    print("Automount encrypted storages")
+    target = select_storage_target()
+
+    luks.create_luks_key_and_update_crypttab(target.mapper_name, target.partition_path)
+    luks.update_fstab(target.mapper_path, target.mount_path)
+
+    ui.success("Installation finished. Please restart :)")