Add orb and sun VMs with virtiofs swarm-common share

- Add orb (192.168.122.183) and sun (192.168.122.184) to inventory
- Create host_vars for orb and sun (fresh install, brew_packages: [])
- Add brew_packages to zap host_vars (gogcli, himalaya, kubernetes-cli, opencode)
- customize.yml: parameterize brew_packages via host_vars, add /mnt/swarm-common
  virtiofs+bindfs mount for all VMs, install bindfs, fix Homebrew install
- provision-vm.yml: remove become requirement; use virsh vol commands for all
  disk/image operations (no sudo needed)
- roles/vm/tasks/main.yml: rewrite disk provisioning to use virsh vol-create-as
  and vol-upload; fix vol name quoting for names with spaces; use qcow2 backing
- domain.xml.j2: always include swarm-common virtiofs share; make main share
  conditional on vm_virtiofs_source/tag

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ansible/playbooks/customize.yml

@@ -5,6 +5,9 @@
 # Usage:
 #   ansible-playbook -i inventory.yml playbooks/customize.yml
 #   ansible-playbook -i inventory.yml playbooks/customize.yml --limit zap
+#
+# Per-host variables (set in host_vars/<name>.yml):
+#   brew_packages: []   # list of Homebrew packages to install
 
 - name: OpenClaw VM customizations
   hosts: openclaw_servers
@@ -26,27 +29,50 @@
         line: 'vm.swappiness=10'
         state: present
 
-    - name: Create virtiofs mount point
+    # ── swarm-common virtiofs share ────────────────────────────────────────
+    # Host: ~/lab/swarm/swarm-common → Guest: /mnt/swarm-common
+    # Virtiofs is mounted raw to /mnt/swarm-common-raw, then bindfs remaps
+    # ownership to openclaw before presenting at /mnt/swarm-common.
+
+    - name: Create swarm-common raw virtiofs mount point
       ansible.builtin.file:
-        path: /mnt/swarm
+        path: /mnt/swarm-common-raw
         state: directory
         mode: "0755"
 
-    - name: Mount virtiofs swarm share via fstab
+    - name: Create swarm-common bindfs mount point
+      ansible.builtin.file:
+        path: /mnt/swarm-common
+        state: directory
+        mode: "0755"
+
+    - name: Install bindfs (for virtiofs ownership remapping)
+      ansible.builtin.apt:
+        name: bindfs
+        state: present
+
+    - name: Add swarm-common virtiofs entry to fstab
       ansible.posix.mount:
-        path: /mnt/swarm
-        src: swarm
+        path: /mnt/swarm-common-raw
+        src: swarm-common
         fstype: virtiofs
         opts: defaults
         state: present
-        # Note: actual mount requires reboot after VM config update
+
+    - name: Add swarm-common bindfs entry to fstab
+      ansible.posix.mount:
+        path: /mnt/swarm-common
+        src: "bindfs#/mnt/swarm-common-raw"
+        fstype: fuse
+        opts: "force-user=openclaw,force-group=openclaw,perms=a+rX,create-for-user=openclaw,create-for-group=openclaw"
+        state: present
 
     - name: Ensure openclaw user lingering is enabled (for user systemd services)
       ansible.builtin.command:
         cmd: loginctl enable-linger openclaw
       changed_when: false
 
-    # ── Homebrew ───────────────────────────────────────────────────────────────
+    # ── Homebrew ───────────────────────────────────────────────────────────
 
     - name: Install Homebrew dependencies
       ansible.builtin.apt:
@@ -58,6 +84,14 @@
           - git
         state: present
 
+    - name: Pre-create /home/linuxbrew owned by openclaw
+      ansible.builtin.file:
+        path: /home/linuxbrew
+        state: directory
+        owner: openclaw
+        group: openclaw
+        mode: "0755"
+
     - name: Install Homebrew (as openclaw user)
       ansible.builtin.shell: |
         NONINTERACTIVE=1 /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
@@ -82,11 +116,7 @@
       environment:
         HOME: /home/openclaw
         PATH: /home/linuxbrew/.linuxbrew/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
-      loop:
-        - gogcli
-        - himalaya
-        - kubernetes-cli
-        - opencode
+      loop: "{{ brew_packages | default([]) }}"
       register: brew_install
       changed_when: "'Installing' in brew_install.stdout"