Fix pipeline not passing the right variuable

.gitea/workflows/gitea-main-ci.yaml

@@ -35,6 +35,12 @@ env:
   PACKER_LOG: "1"
   OCI_IMAGE: "git.bitasylum.org/audiobuzz/fleet-boot"
   NIC_DRIVERS: "ice mlx5_core"
+  # NVMe/TCP discovery address baked into the (immutable) UKI cmdline
+  # (rd.nvmf.discover). For the open-network test this is the lab serving host's
+  # IP so the initramfs needs no DNS resolution. Production: switch to a
+  # per-environment DNS name (e.g. nvme.fleet.lab) resolved at boot so one UKI
+  # works across environments — the serving stack's dnsmasq resolves it.
+  NVMET_TRADDR: "192.168.50.10"
   # ===========================================================================
   # TEMPORARY: 802.1X + MACsec are DISABLED for this build (rd.dot1x=0) so the
   # UKI / rootfs / NVMe-oF boot path can be validated on an OPEN switch port.
@@ -146,4 +152,5 @@ jobs:
             -var oci_image="${{ env.OCI_IMAGE }}" \
             -var oci_push=true \
             -var disable_dot1x=${{ env.DISABLE_DOT1X }} \
+            -var nvmet_traddr="${{ env.NVMET_TRADDR }}" \
             .

serving/.env.example

@@ -1,7 +1,7 @@
 # Copy to .env and edit for your test LAN/bridge, then: docker compose up -d
 
 # Release being served. Must match the Packer build (fleet-<version>.efi).
-IMAGE_VERSION=0.0.0-cbd92ba
+IMAGE_VERSION=0.0.0-754eced
 
 # OCI release-artifact image (built by scripts/build-oci.sh). Mounted directly
 # as a Docker image volume — the default artifact source. Pin by digest in
@@ -10,7 +10,7 @@ OCI_IMAGE=git.bitasylum.org/audiobuzz/fleet-boot
 
 # Fallback only (Docker < 28 / offline): local Packer output dir, used by the
 # commented bind-mounts in docker-compose.yml. Ignored when image volumes work.
-ARTIFACT_SRC=../artifacts/0.0.0-cbd92ba
+ARTIFACT_SRC=../artifacts/0.0.0-754eced
 
 # SPDK NVMe/TCP target image — prebuilt + pushed by CI
 # (.gitea/workflows/spdk-image.yaml); the serving host just pulls it.