Add owner-aware OCI tmpfs mounts

oci/catalog/apps/input.json

@@ -400,11 +400,27 @@
         "request_timeout_seconds": 10,
         "stability_seconds": 4,
         "verify_tls": true
-      }
+      },
+      "tmpfs_mounts": [
+        {
+          "id": "runtime",
+          "container_path": "/run",
+          "default_size_mb": 64,
+          "minimum_size_mb": 16,
+          "prompt_size": false,
+          "mount_options": [
+            "rw",
+            "nosuid",
+            "nodev"
+          ],
+          "owner_strategy": "image-user",
+          "mode": "0755"
+        }
+      ]
     }
   },
   "compatibility": {
-    "automatic_install_candidate": false,
+    "automatic_install_candidate": true,
     "validated": false,
     "supported_compose_keys": [
       "image",
@@ -414,7 +430,7 @@
       "environment"
     ],
     "untranslated_blockers": [],
-    "policy": "Excluded from the installable catalog pending compatibility review. The tested image runs as nobody, but its nginx and PHP-FPM startup requires writable runtime paths under /run; the current native OCI-LXC recipe could not start the service. Do not install until a supported runtime mapping is confirmed."
+    "policy": "The image runs nginx and PHP-FPM as its OCI image user. ProxMenux provides a native /run tmpfs owned by that effective LXC init user, with writable mode for the runtime files. The recipe remains unvalidated until a clean install passes its startup health check."
   },
   "validation": {
     "schema": "passed-at-generation",

oci/catalog/curated/input.json

@@ -400,11 +400,27 @@
         "request_timeout_seconds": 10,
         "stability_seconds": 4,
         "verify_tls": true
-      }
+      },
+      "tmpfs_mounts": [
+        {
+          "id": "runtime",
+          "container_path": "/run",
+          "default_size_mb": 64,
+          "minimum_size_mb": 16,
+          "prompt_size": false,
+          "mount_options": [
+            "rw",
+            "nosuid",
+            "nodev"
+          ],
+          "owner_strategy": "image-user",
+          "mode": "0755"
+        }
+      ]
     }
   },
   "compatibility": {
-    "automatic_install_candidate": false,
+    "automatic_install_candidate": true,
     "validated": false,
     "supported_compose_keys": [
       "image",
@@ -414,7 +430,7 @@
       "environment"
     ],
     "untranslated_blockers": [],
-    "policy": "Excluded from the installable catalog pending compatibility review. The tested image runs as nobody, but its nginx and PHP-FPM startup requires writable runtime paths under /run; the current native OCI-LXC recipe could not start the service. Do not install until a supported runtime mapping is confirmed."
+    "policy": "The image runs nginx and PHP-FPM as its OCI image user. ProxMenux provides a native /run tmpfs owned by that effective LXC init user, with writable mode for the runtime files. The recipe remains unvalidated until a clean install passes its startup health check."
   },
   "validation": {
     "schema": "passed-at-generation",

oci/catalog/index.json

@@ -6194,7 +6194,7 @@
       "curated_path": "catalog/curated/input.json",
       "template": "apps/input.json",
       "template_status": "generated-unvalidated",
-      "automatic_install_candidate": false,
+      "automatic_install_candidate": true,
       "untranslated_blockers": [],
       "requires_privileged_lxc": false,
       "optional_privileged_lxc": false,
@@ -6202,7 +6202,7 @@
       "requires_relaxed_confinement": false,
       "optional_relaxed_confinement": false,
       "requires_security_confirmation": false,
-      "hidden": true,
+      "hidden": false,
       "template_id": "image-input"
     },
     {