FHS F4.1: ssh host keys + iwd state to /var/lib (credentials)

Two security-sensitive state dirs migrated to Arch-standard locations.

openssh:
- --with-keydir flipped from /storage/.cache/ssh to /var/lib/sshd.
- post_install plants a bridge symlink /var/lib/sshd ->
  /storage/.cache/ssh so keys persist on the rw overlay.
- sshd.service updates all three ExecStartPre paths.
- tmpfiles z_04_openssh.conf keeps creating /storage/.cache/ssh as
  the real overlay dir.

iwd:
- Environment STATE_DIRECTORY in iwd.service now /var/lib/iwd.
- post_makeinstall_target adds the /var/lib/iwd ->
  /storage/.cache/iwd bridge symlink.
- wifictl (IWD_DIR, IWD_AP_CFG_DIR), post-update copy target and
  userconfig-setup all flipped to /var/lib/iwd.
- tmpfiles z_03_iwd.conf keeps creating the backing dirs.

Both follow the same bridge pattern as F2/F3: FHS surface, storage
overlay substrate. SSH host keys and wifi credentials survive the
migration because the underlying bytes never move (symlink swap).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

projects/ArchR/packages/archr/sources/post-update

@@ -60,7 +60,7 @@ echo "Apply dev wifi config if available..." >>${LOG}
 if [ -d /usr/config/iwd ]
 then
   tocon "Update developer wifi config..."
-  cp /usr/config/iwd/* /storage/.cache/iwd/
+  cp /usr/config/iwd/* /var/lib/iwd/
 fi
 
 ### Sync rsync configs

projects/ArchR/packages/archr/sources/scripts/wifictl

@@ -14,7 +14,7 @@
 ###     wifictl command [ssid] [psk]
 ###
 
-IWD_AP_CFG_DIR="/storage/.cache/iwd/ap"
+IWD_AP_CFG_DIR="/var/lib/iwd/ap"
 WIFI_TYPE=$(get_setting wifi.adhoc.enabled)
 NETWORK_ADDRESS="192.168.80"
 ADHOC_CLIENT_ID=$(get_setting wifi.adhoc.id)
@@ -67,7 +67,7 @@ connect_wifi() {
   sleep 1
 
   # Create iwd network profile for persistent connection
-  IWD_DIR="/storage/.cache/iwd"
+  IWD_DIR="/var/lib/iwd"
   mkdir -p "${IWD_DIR}"
   if [ -n "${PSK}" ]; then
     printf '[Security]\nPassphrase=%s\n' "${PSK}" > "${IWD_DIR}/${SSID}.psk"

projects/ArchR/packages/network/iwd/package.mk

@@ -19,4 +19,10 @@ post_makeinstall_target() {
 
   mkdir -p ${INSTALL}/usr/bin
     cp -P ${PKG_DIR}/scripts/iwd_get-networks ${INSTALL}/usr/bin
+
+  # FHS bridge: /var/lib/iwd is the Arch-standard state dir. tmpfiles
+  # z_03_iwd.conf creates the backing /storage/.cache/iwd so the
+  # symlinked target is writable on first boot.
+  mkdir -p ${INSTALL}/var/lib
+  ln -sf /storage/.cache/iwd ${INSTALL}/var/lib/iwd
 }

projects/ArchR/packages/network/iwd/system.d/iwd.service

@@ -7,7 +7,7 @@ Before=network.target
 Wants=network.target
 
 [Service]
-Environment=STATE_DIRECTORY=/storage/.cache/iwd
+Environment=STATE_DIRECTORY=/var/lib/iwd
 Type=dbus
 BusName=net.connman.iwd
 ExecStart=/usr/lib/iwd

projects/ArchR/packages/network/openssh/package.mk

@@ -28,7 +28,7 @@ PKG_CONFIGURE_OPTS_TARGET="ac_cv_header_rpc_types_h=no \
                            --disable-pututline \
                            --disable-pututxline \
                            --disable-etc-default-login \
-                           --with-keydir=/storage/.cache/ssh \
+                           --with-keydir=/var/lib/sshd \
                            --without-pam"
 
 pre_configure_target() {
@@ -55,4 +55,11 @@ post_makeinstall_target() {
 
 post_install() {
   enable_service sshd.service
+
+  # FHS bridge for host keys: --with-keydir is baked at configure time
+  # to /var/lib/sshd. Symlink it into /storage/.cache/ssh (rw overlay)
+  # so the keys persist across reboots. The backing path is still
+  # created by tmpfiles z_04_openssh.conf.
+  mkdir -p ${INSTALL}/var/lib
+  ln -sf /storage/.cache/ssh ${INSTALL}/var/lib/sshd
 }

projects/ArchR/packages/network/openssh/system.d/sshd.service

@@ -8,10 +8,10 @@ ConditionPathExists=|/storage/.cache/services/sshd.conf
 [Service]
 Restart=on-failure
 EnvironmentFile=-/storage/.cache/services/sshd.conf
-ExecStartPre=-/bin/sh -c 'mkdir -p /storage/.cache/ssh'
+ExecStartPre=-/bin/sh -c 'mkdir -p /var/lib/sshd'
 ExecStartPre=/usr/bin/ssh-keygen -A
-ExecStartPre=-/bin/sh -c 'chmod 600 /storage/.cache/ssh/ssh_host_*'
-ExecStartPre=-/bin/sh -c 'chmod 644 /storage/.cache/ssh/ssh_host_*.pub'
+ExecStartPre=-/bin/sh -c 'chmod 600 /var/lib/sshd/ssh_host_*'
+ExecStartPre=-/bin/sh -c 'chmod 644 /var/lib/sshd/ssh_host_*.pub'
 ExecStart=/usr/sbin/sshd -D $SSH_ARGS
 ExecReload=/bin/kill -HUP $MAINPID
 TimeoutStopSec=1s

projects/ArchR/packages/sysutils/systemd/scripts/userconfig-setup

@@ -33,7 +33,7 @@ then
   if [ -d /usr/config/iwd ]
   then
     tocon "Update developer wifi config..."
-    cp /usr/config/iwd/* /storage/.cache/iwd/
+    cp /usr/config/iwd/* /var/lib/iwd/
   fi
 
   if [ -e "/usr/bin/emulationstation" ]