Deliver tested native Alloy and backup recovery sources

ci/packer/apex-debian-13.pkr.hcl

@@ -61,7 +61,7 @@ build {
   sources = ["source.qemu.apex_debian"]
 
   provisioner "file" {
-    source      = "engine"
+    source      = "ci/scripts/init-node/provisioning"
     destination = "/tmp/"
   }
 
@@ -69,8 +69,8 @@ build {
     execute_command = "sudo -n sh -c '{{ .Vars }} {{ .Path }}'"
     environment_vars = ["APEX_PROVISION_REVISION=${var.provision_revision}"]
     inline = [
-      "bash /tmp/engine/provisioning/seed.sh",
-      "cd /tmp && python3 -m engine.provisioning.image install"
+      "bash /tmp/provisioning/seed.sh",
+      "cd /tmp && python3 -m provisioning.image install"
     ]
   }
 
@@ -79,6 +79,7 @@ build {
     scripts = [
       "ci/packer/scripts/01-base-system.sh",
       "ci/packer/scripts/02-storage-docker.sh",
+      "ci/packer/scripts/02-alloy-package.sh",
       "ci/packer/scripts/03-bootstrap-helper.sh",
       "ci/packer/scripts/04-cleanup.sh"
     ]

ci/packer/scripts/02-alloy-package.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+# Service configuration and credentials are deployed later by apex configure/alloy.
+alloy_version=1.21.3
+alloy_sha256=dbbd705de8ab37dec0cbd6361a3fc7e754d6b2854b57ce672a83e6366199ba73
+[[ "$(dpkg --print-architecture)" == amd64 ]]
+alloy_deb=$(mktemp --suffix=.deb)
+trap 'rm -f "$alloy_deb"' EXIT
+curl --fail --location --retry 3 --output "$alloy_deb" \
+  "https://github.com/grafana/alloy/releases/download/v${alloy_version}/alloy-${alloy_version}-1.amd64.deb"
+printf '%s  %s\n' "$alloy_sha256" "$alloy_deb" | sha256sum --check --status
+systemctl mask alloy.service
+DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends "$alloy_deb"
+systemctl disable --now alloy.service
+systemctl unmask alloy.service
+! systemctl is-active --quiet alloy.service
+! systemctl is-enabled --quiet alloy.service