Turn off kiosk by default

diskless.pkr.hcl

@@ -112,6 +112,12 @@ variable "admin_user" {
   default     = "fleetadmin"
 }
 
+variable "enable_kiosk" {
+  type        = bool
+  description = "Build-time feature flag for the graphical kiosk (weston + Chromium + mesa). false (default, current) skips the kiosk provisioner entirely — much faster builds and a far smaller image — while iterating on the boot/network stack. Set true to bake the kiosk back in. (kiosk_url=\"\" also skips it; this flag lets you disable without losing the configured URL.)"
+  default     = false
+}
+
 variable "kiosk_url" {
   type        = string
   description = "URL the fullscreen Chromium kiosk loads at boot (cage Wayland session on tty1, baked into the immutable root). Empty disables the kiosk install entirely. A runtime config-agent could override it later via /etc/kiosk/kiosk.env."
@@ -269,9 +275,13 @@ build {
   # to verify; likely tweak points: chromium ozone/wayland, --disable-gpu vs a
   # real GPU, /dev/dri present in the VM, and SELinux AVCs for the GUI stack.
   provisioner "shell" {
-    environment_vars = ["KIOSK_URL=${var.kiosk_url}"]
+    environment_vars = [
+      "ENABLE_KIOSK=${var.enable_kiosk}",
+      "KIOSK_URL=${var.kiosk_url}",
+    ]
     inline = [
       "set -e",
+      "if [ \"$ENABLE_KIOSK\" != \"true\" ]; then echo 'enable_kiosk=false -> skipping kiosk install (smaller/faster build).'; exit 0; fi",
       "if [ -z \"$KIOSK_URL\" ]; then echo 'kiosk_url empty -> skipping kiosk install.'; exit 0; fi",
       "echo '==> Enabling EPEL + installing kiosk stack (weston, chromium, mesa)'",
       "dnf install -y epel-release",