commit 9a412e7d871b00cebd67a7af0680747a2b9663fa
Author: Ivan S. Titov <iohann.s.titov@gmail.com>
Date: Thu Jul 30 11:18:08 2026 +0200

sci-ml/lemonade: drop 11.5.0-r1

Fully superseded by 11.5.1 (a verbatim copy carrying all of the -r1
service/webui/tauri packaging). Retention keeps 10.10.0-r3 and 11.0.0-r1
as the 10.x/11.0 rollback anchors plus the live ebuild.

commit b41a61a5c699dad07b0eef2c1517b78d919b4112
Author: Ivan S. Titov <iohann.s.titov@gmail.com>
Date: Thu Jul 30 11:17:54 2026 +0200

sci-ml/lemonade: add 11.5.1

Patch release. The upstream v11.5.0..v11.5.1 diff leaves every
load-bearing packaging surface unchanged: the CMakeLists install/systemd/
web-app rules and the cpp-httplib FetchContent block are untouched (only
BUILD_TESTING test targets were added), backend_versions.json keeps
therock.version 7.13.0 so the <therock-bin-7.14 cap still holds, and the
config-seed defaults.json backend sections are unchanged. Copied from
11.5.0-r1 minus the revision bump.

commit d7cd3e5ef88649a95247cc29760dfdaba2870e58
Author: Ivan S. Titov <iohann.s.titov@gmail.com>
Date: Sat Jul 25 19:15:43 2026 +0200

sci-ml/lemonade: pin flm.npu_bin on 11.0.0 and 9999

Propagate the 11.5.0-r1 flm.npu_bin config-seed pin to the remaining
versions. 11.0.0 and 9999 carry the identical flm resolver:
find_flm_in_path() consults PATH only when flm.prefer_system is set, so a
bare /usr/bin/flm is invisible by default and lemond reports the NPU
backend "supported but not installed" (and would re-download the flm NPU
runtime). Both defaults.json carry an flm section, so the has() guard
passes.

Same edits as 11.5.0-r1: add the flm npu_bin pin to the jqf block,
system-fastflowlm to the app-misc/jq BDEPEND, and correct the
pkg_postinst elog/ewarn. 11.0.0 is revbumped to r1 (installed content
changes); 9999's elog/ewarn drop the version-specific "11.x" wording
since it tracks HEAD.

commit bc93056f52b91dcbb664411e724b379f090e5b6c
Author: Ivan S. Titov <iohann.s.titov@gmail.com>
Date: Sat Jul 25 19:05:07 2026 +0200

sci-ml/lemonade: pin flm.npu_bin for system-fastflowlm reuse

system-fastflowlm RDEPENDs sci-ml/fastflowlm to put /usr/bin/flm on PATH,
but lemond 11.x consults PATH for flm only when flm.prefer_system is set --
a bare flm on PATH is otherwise invisible to the resolver. The reuse pin
was missing from the config-seed defaults.json, so lemond reported the NPU
backend "supported but not installed" and would re-download the flm NPU
runtime on first use instead of reusing the packaged one.

Pin flm.npu_bin=/usr/bin/flm in the seed. The npu_bin override is step 1 of
flm's resolver (ahead of the prefer_system PATH lookup), so it is picked up
regardless of prefer_system, mirroring the other system-* backends. flm has
a single fixed npu backend, so only the *_bin is pinned (no backend key to
route). Add app-misc/jq to BDEPEND for system-fastflowlm, and correct the
pkg_postinst elog/ewarn, which wrongly claimed a packaged flm on PATH is
used automatically.

Existing configs are not touched by the rebuild; pkg_postinst points users
at `lemonade config set flm.npu_bin=/usr/bin/flm` for those.

commit 151198efc7174d4574912838893fc17f00a1af75
Author: Ivan S. Titov <iohann.s.titov@gmail.com>
Date: Wed Jul 22 23:58:12 2026 +0200

sci-ml/lemonade: add 11.5.0

commit f5d7845090e522c645c3d953db1f70bc101949e7
Author: Ivan S. Titov <iohann.s.titov@gmail.com>
Date: Sun Jul 19 13:45:40 2026 +0200

sci-ml/lemonade: depend on libdrm[video_cards_amdgpu]

system_info.cpp includes <libdrm/amdgpu.h> unconditionally under __linux__ and CMake
links drm_amdgpu into lemonade-server-core, calling amdgpu_device_initialize()
directly rather than via dlopen. The header and libdrm_amdgpu.so are therefore hard
build and runtime requirements on every Linux host, not only AMD ones; only libdrm
built with video_cards_amdgpu provides them. Without the flag the build fails at
"libdrm/amdgpu.h: No such file or directory". New in 11.0.0.

commit e6ff34394c5fdc5b6be78dd6ff80405a8b0fc131
Author: Ivan S. Titov <iohann.s.titov@gmail.com>
Date: Thu Jul 16 14:40:05 2026 +0200

sci-ml/lemonade: add system-rocm / system-therock ROCm-source USE flags

Two mutually-exclusive flags select where lemond's rocm-stable image/audio
backend gets its ROCm runtime, so it reuses a system ROCm via ROCM_PATH
instead of downloading AMD's ~3 GB TheRock at first use:

- system-rocm -> /usr (Gentoo's ROCm; lemond blind-trusts it as /usr has no
version file). Pulls dev-util/hip.
- system-therock -> /opt/therock-bin (dev-util/therock-bin). lemond gates on a
major.minor match with its pinned backend_versions.json therock.version
(7.13), so the RDEPEND holds therock-bin to the >=7.13.0 <7.14 line; a 7.14
tree carries .info/version=7.14.0 and is rejected.

src_install bakes the choice in -- the OpenRC confd value and a systemd
Environment drop-in on both units; a manual launch exports ROCM_PATH itself
(pkg_postinst). Added to 11.0.0 and the live 9999; 10.10.0-r3 keeps its
released flag set.

commit 2a99c9be4cb211584d62f3218b7aa901f529915c
Author: Ivan S. Titov <iohann.s.titov@gmail.com>
Date: Thu Jul 16 13:24:05 2026 +0200

sci-ml/lemonade: bring 9999 to 11.0.0 packaging parity

9999 (live) still carried the 10.10.0-r3-era packaging; fold in the
audit-surfaced 11.0.0 changes so HEAD ships the same interface:

- webui? ( app-misc/jq x11-misc/xdg-utils ) RDEPEND -- the lemonade-web-app
launcher runs under set -e and needs jq for port discovery (aborts without
it), opening the browser via xdg-open.
- the -system-fastflowlm ewarn that lemond auto-downloads the flm NPU runtime
on first NPU use, plus the webui browser-launcher post-install note.
- comment refresh (the webui launcher/jq rationale; the examples/ dir now also
ships non-systemd API samples so the strip's rmdir no-ops).

Live-ebuild specifics (git-r3, no KEYWORDS, HEAD-framed comments) stay as-is.

commit 6954be526378d8d4fb08036e22d1123a940e377f
Author: Ivan S. Titov <iohann.s.titov@gmail.com>
Date: Thu Jul 16 13:20:51 2026 +0200

sci-ml/lemonade: rename USE=fastflowlm to system-fastflowlm

fastflowlm is a use-the-packaged-backend flag exactly like the system-*
family: it RDEPENDs sci-ml/fastflowlm so lemond resolves /usr/bin/flm on
PATH instead of auto-downloading the flm NPU runtime at first NPU use. Name
it to match. Renamed in the live 9999 and going forward in 11.0.0 (and
regrouped with the other system-* deps); 10.10.0-r3 keeps its released
fastflowlm flag until it is dropped, so metadata.xml describes both.

commit ed646aa885aabbf7364259845d9e205e5cd83981
Author: Ivan S. Titov <iohann.s.titov@gmail.com>
Date: Thu Jul 16 10:50:49 2026 +0200

sci-ml/lemonade: drop 10.9.0

commit 58dba04168541bfff5682be89a369075cd56434e
Author: Ivan S. Titov <iohann.s.titov@gmail.com>
Date: Thu Jul 16 10:50:48 2026 +0200

sci-ml/lemonade: add 11.0.0

Major bump; re-audit of the CMake build interface against 11.0.0:

- httplib's FetchContent_Declare now carries a bare commit SHA instead of
10.x's `GIT_TAG v$`, so the CMake-4 repin sed is
switched to a range match on the declare block (matching the -9999
ebuild) -- the old fixed-string sed would no-op and refetch v0.26.0.
- USE=webui now also installs a lemonade-web-app browser launcher, a
.desktop entry and a pixmap icon; the launcher uses jq (under set -e)
for port discovery and xdg-open as the browser fallback, so USE=webui
gains an app-misc/jq + x11-misc/xdg-utils RDEPEND.
- The -systemd payload strip is re-confirmed against 11.0.0 (system+user
units, sysusers.d/lemonade.conf, conf.d/zz-secrets.conf, the migrate
helper); examples/ now also ships non-systemd API samples, so the
trailing rmdir no-ops.
- Without USE=fastflowlm, lemond 11.x auto-downloads the flm NPU runtime
on first NPU use; noted in pkg_postinst (a packaged sci-ml/fastflowlm
on PATH takes precedence in flm resolution).

commit 43a21eb58795d8f5fc2768b303743c1e4d39e214
Author: Ivan S. Titov <iohann.s.titov@gmail.com>
Date: Wed Jul 15 09:37:18 2026 +0200

sci-ml/lemonade: backport packaging parity to 10.9.0

10.9.0, the previous release kept for rollback, carried only the minimal
server build. Sync it to the current release body so the rollback target is
usable: the OpenRC + systemd service (unit gating plus the sysusers/secrets
strip), acct-user/acct-group, the system-* backend reuse flags,
ROCM_PATH/TheRock avoidance, the webui and tauri USE flags, and the hardened
post-install notes. Its cpp-httplib pin keeps the stable
`GIT_TAG v$` match (the SHA drift is HEAD-only).

commit 5d99717ca6fead1fa52484363cb328fbf5768554
Author: Ivan S. Titov <iohann.s.titov@gmail.com>
Date: Wed Jul 15 09:35:15 2026 +0200

sci-ml/lemonade: bring 9999 live ebuild to packaging parity

The 9999 live ebuild carried only the minimal server build, missing all the
packaging the release ebuild grew: the OpenRC + systemd service (unit gating
plus the sysusers/secrets strip), acct-user/acct-group, the system-* backend
reuse flags, ROCM_PATH/TheRock avoidance, the webui and tauri USE flags, and
the hardened post-install notes. Sync it to the release body.

Also repin the cpp-httplib FetchContent to v0.38.0 by rewriting the httplib
FetchContent_Declare block's GIT_TAG whatever its form, instead of matching
the fixed `GIT_TAG v$` string: upstream now expresses
that tag as a bare commit SHA at HEAD, so the old sed silently no-op'd and
the build fetched the CMake-4-incompatible v0.26.0.

commit 9808c3cecaece1b9cb51ee7e3c663c8c06667250
Author: Ivan S. Titov <iohann.s.titov@gmail.com>
Date: Wed Jul 15 09:24:23 2026 +0200

sci-ml/lemonade: strip leaked systemd sysusers/secrets files on -systemd

Upstream's CPack "if(UNIX AND NOT APPLE)" block installs a full systemd
payload unconditionally; the -systemd strip only removed the two units and
the migrate helper, leaving /usr/lib/sysusers.d/lemonade.conf and
/etc/lemonade/conf.d/zz-secrets.conf behind on OpenRC / unit-less installs.

sysusers.d/lemonade.conf is redundant with the unconditional
acct-user/lemonade. zz-secrets.conf is worse than dead weight: it is a
systemd EnvironmentFile, but the OpenRC init reads /etc/conf.d/lemonade, so
an API key placed in /etc/lemonade/conf.d/ is silently ignored (the service
runs with no auth) rather than applied. Strip both, plus the now-empty
/etc/lemonade tree, alongside the units.

commit 31c311dbeb44ab1291608f32a33dd4809b48d14a
Author: Ivan S. Titov <iohann.s.titov@gmail.com>
Date: Wed Jul 15 00:14:50 2026 +0200

sci-ml/lemonade: add tauri USE flag for the desktop app

Builds the Tauri desktop app (lemonade-app), a native webkit2gtk window
wrapping the same renderer USE=webui serves in a browser. It runs `npm
ci` in src/app then `tauri build --no-bundle` (webpack renderer + a cargo
LTO release of the Rust host); the crates.io fetch rides the network
build the ebuild already needs.

BUILD_TAURI_APP stays OFF deliberately: upstream's ON path builds the app
during the CMake configure step (which fails on a clean build -- no
CMakeCache.txt yet) and gates its install() rules on the binary already
existing at configure time. The tauri-app custom target is defined
whenever node+npm+cargo are present regardless of that flag, so
src_compile builds it directly and src_install places the binary,
.desktop and icon by hand.

Runtime deps are what the binary links (per ldd): webkit-gtk:4.1, gtk+:3
and libsoup:3.0. Off by default; enabling it pulls a Rust toolchain.

commit 533fdec9b05af213bd53bef668c2e44661e668d9
Author: Ivan S. Titov <iohann.s.titov@gmail.com>
Date: Tue Jul 14 22:53:50 2026 +0200

sci-ml/lemonade: add webui USE flag for the bundled web frontend

lemond serves a React single-page app at the server root (/) when

resources/web-app/ is present; the build passed -DBUILD_WEB_APP=OFF, so

lemond only served a static "built without a web app" placeholder there.

The new webui flag flips BUILD_WEB_APP=ON, which runs npm ci + webpack at

build time (net-libs/nodejs provides node+npm) and stages the SPA into

share/lemonade-server/resources/web-app/, where lemond auto-detects and

serves it.

The npm fetch fits the existing network build (PROPERTIES=live plus

FetchContent under RESTRICT=network-sandbox). Upstream's

USE_SYSTEM_NODEJS_MODULES path avoids the fetch but needs React, webpack

and the KaTeX assets resolvable under /usr/share/nodejs, which ::gentoo

does not package, so npm-at-build is the only viable route. Off by

default; the Tauri desktop wrapper stays unbuilt.

commit a2b7de46d185ce6fb07cf88566dec63da9b227d3
Author: Ivan S. Titov <iohann.s.titov@gmail.com>
Date: Tue Jul 14 17:14:50 2026 +0200

sci-ml/lemonade: drop stale lemonade-server hint from 10.9.0 postinst

The lemonade-server shim is no longer installed -- the build ships only
lemond and the lemonade CLI, and running lemonade-server errors. 10.10.0
already dropped this quick-start line; 10.9.0 was the last ebuild still
advertising it.

commit 96e1a29b7811f1fcf1d0cc49d47124bb4c72e7a0
Author: Ivan S. Titov <iohann.s.titov@gmail.com>
Date: Tue Jul 14 16:39:46 2026 +0200

sci-ml/lemonade: fix OpenRC service failing to start

The service reported started but lemond exited immediately for two reasons
the hand-written init script never handled:

- lemond needs a writable XDG_RUNTIME_DIR (or RUNTIME_DIRECTORY) for its
control socket and refuses to start without one. supervise-daemon runs
with a clean environment that has none -- elogind's /run/user/<uid> only
exists after an interactive login, so a boot-time service cannot rely on
it. The upstream systemd unit covers this with RuntimeDirectory=lemonade;
mirror it by creating /run/lemonade (0700, owned by LEMONADE_USER) and
exporting XDG_RUNTIME_DIR.

- supervise-daemon opens the stdout/stderr redirect (LEMONADE_LOG) itself,
as the dropped user rather than as root, and dup2s it onto the child's
fds. /var/log is root-owned, so that open failed and lemond never got a
valid stdout, dying before writing a line. Pre-create the log (0640, owned
by LEMONADE_USER) in start_pre.

Both paths are overridable via LEMONADE_RUNTIME_DIR and LEMONADE_LOG in
conf.d. Revbump so installed systems pick up the corrected service scripts.

commit 65a6a62508718e0d80b92020437d7515de0546fc
Author: Ivan S. Titov <iohann.s.titov@gmail.com>
Date: Tue Jul 14 14:06:58 2026 +0200

sci-ml/lemonade: reuse system ROCm to skip the TheRock download

lemond's bundled ROCm image/audio backends (sd-cpp, acestep, thinksound)
fetch AMD's multi-GB TheRock ROCm runtime into the user cache at first
use -- ~3 GB compressed, >7 GB unpacked -- which can overflow a small
/home, even though the prebuilt binaries link fine against system ROCm.

The OpenRC service now exports ROCM_PATH=/usr (Gentoo's ROCm prefix), so
lemond reuses the installed runtime and skips TheRock; documented and
overridable in conf.d. pkg_postinst now warns about the download on the
default path and points at USE=system-sdcpp (a fetch-free Vulkan route)
and the ROCM_PATH fallback. A conf.d note guards against dropping a ROCm
version file, which would make lemond gate on an exact major.minor match
against TheRock's pin and re-fetch it.

Also drops a host-specific ISA/performance claim from the reuse-block
post-install notes.

commit 8a64eda51b4179f4dfeb15ceec1c9cdfa89f7415
Author: Ivan S. Titov <iohann.s.titov@gmail.com>
Date: Sun Jul 12 23:41:03 2026 +0200

sci-ml/lemonade: drop stale lemonade-server hint from post-install notes

The C++ server ships only lemond and the lemonade CLI; the lemonade-server
shim is no longer installed, so the quick-start note pointed users at a
command that errors with "not found". Drop the line.

commit 0da5d3d132e2e3938a38508e8146bca907677a1b
Author: Ivan S. Titov <iohann.s.titov@gmail.com>
Date: Sun Jul 12 08:48:39 2026 +0200

sci-ml/lemonade: add system-<backend> binary-reuse USE flags

Add system-<backend> USE flags (system-llamacpp, system-whispercpp,
system-sdcpp, system-kokoro): each RDEPENDs the matching portage-managed
package and jq-pins that backend + its <backend>_bin in the installed
defaults.json, so lemond reuses the system binary (llama-server,
whisper-server, sd-server, koko) instead of fetching an upstream prebuilt
into ~/.cache/lemonade/ at runtime. Pinning the backend is required because
lemond's "auto" resolves per-backend and only reads the resolved backend's
*_bin; the pinned value is just lemond's routing to the binary, not a GPU
selector.

The deps carry no backend USE constraint -- which ggml backend actually
runs is the binary's own choice (gpu_device 0 = first-registered), so a
multi-backend build picks ROCm/CUDA over Vulkan. pkg_postinst documents this
and recommends building the package vulkan-only, since Vulkan out-runs
ROCm/OpenCL on the Ryzen AI iGPU and OpenCL additionally aborts sd-server on
its XRT ICD. A has() guard fails the build if a future lemonade renames a
defaults.json section rather than silently mis-pinning.

commit 3afb914990c99f5c693cac7740057daf9f80a977
Author: Ivan S. Titov <iohann.s.titov@gmail.com>
Date: Sat Jul 11 23:39:12 2026 +0200

sci-ml/lemonade: add OpenRC service, gate systemd units by USE

Upstream's CMake unconditionally installs systemd units (system + user)
that run as User=lemonade, an account nothing provided, and ships no
OpenRC integration at all.

Add IUSE="openrc systemd". Under USE=systemd keep the vendor units;
otherwise strip them and the systemd migration helper so non-systemd
installs do not carry dead files. Add acct-user/acct-group/lemonade
(unconditionally, matching sci-ml/ollama) to back the system unit's
User=lemonade.

Add an OpenRC init.d/conf.d pair modelled on the sibling llama-swap and
fastflowlm services: a supervise-daemon service that refuses to start
until LEMONADE_USER is set and passes --host 127.0.0.1, which overrides
config.json and forces a loopback bind. Reaching other interfaces now
takes a deliberate conf.d edit.

lemond already defaults to a loopback bind, so this changes packaging
and init-system coverage, not the default network exposure.

commit 7c1578ba25d674d4db502bd3d092d1fd4b84f196
Author: Ivan S. Titov <iohann.s.titov@gmail.com>
Date: Fri Jul 10 14:38:56 2026 +0200

sci-ml/lemonade: drop 10.7.0, 10.8.0, 10.8.1

commit 8b5c98e026910bff0b4dd26e94605dfe38963893
Author: Ivan S. Titov <iohann.s.titov@gmail.com>
Date: Fri Jul 10 14:38:38 2026 +0200

sci-ml/lemonade: add 10.10.0

commit 83f9817c9e3b4f0e653e02b940f648c5a312e745
Author: Ivan S. Titov <iohann.s.titov@gmail.com>
Date: Wed Jul 1 21:27:07 2026 +0200

sci-ml/lemonade: drop 10.6.0

commit 38b78a51005c356a4d66b77a1f92d4bb51e8ae37
Author: Ivan S. Titov <iohann.s.titov@gmail.com>
Date: Wed Jul 1 21:26:37 2026 +0200

sci-ml/lemonade: add 10.9.0

commit 2e3c555c2c6f051cc769f10b3de59c7d781cb5a0
Author: Ivan S. Titov <iohann.s.titov@gmail.com>
Date: Thu Jun 25 16:54:33 2026 +0200

sci-ml/lemonade: add 10.8.1

commit ef1be2079517348782b03ab51c84cb790d617ce7
Author: Ivan S. Titov <iohann.s.titov@gmail.com>
Date: Thu Jun 18 08:10:39 2026 +0200

sci-ml/lemonade: add 10.8.0

commit d1abb8ed6989e82e8d3fc1c0d13651c109ec047e
Author: Ivan S. Titov <iohann.s.titov@gmail.com>
Date: Wed Jun 10 23:03:16 2026 +0200

sci-ml/lemonade: pin cpp-httplib fetch to v0.38.0 for CMake 4

When ::gentoo's cpp-httplib isn't pkg-config-detectable (no .pc),
upstream FetchContents cpp-httplib at v$ (0.26.0).
That tag's CMakeLists.txt has a malformed
`if(... AND VERSION_LESS 10.0.0)` that CMake 4 rejects with "Unknown
arguments specified", breaking the build. Pin the fetch to v0.38.0 —
the version we ship as dev-cpp/cpp-httplib, API-compatible with the
>=0.26.0 floor. 10.7.0 already carries this; backport to the retained
10.6.0 and the live 9999.

In place on 10.6.0 (no revbump): build-system-only, so existing
installs are untouched — it only repairs a fresh or rollback build on
CMake 4.

commit f548569e423642d45e65827083cef14ff30efa71
Author: Ivan S. Titov <iohann.s.titov@gmail.com>
Date: Wed Jun 10 22:56:50 2026 +0200

sci-ml/lemonade: drop 10.5.0

Retention: keep 10.6.0 and 10.7.0.

commit e39a7694350190edbef70f35484e7c051308934e
Author: Ivan S. Titov <iohann.s.titov@gmail.com>
Date: Wed Jun 10 20:02:08 2026 +0200

sci-ml/lemonade: add 10.7.0

commit 4b8bedd13c5684e3ec8da8f5fd23ce3bb29511df
Author: Ivan S. Titov <iohann.s.titov@gmail.com>
Date: Sat Jun 6 21:03:14 2026 +0200

sci-ml/lemonade: drop 10.4.0

commit f2a5d112a214f7c40002855cf9c93804cd25c077
Author: Ivan S. Titov <iohann.s.titov@gmail.com>
Date: Sat May 23 00:41:09 2026 +0200

sci-ml/lemonade: add 10.6.0

commit 7f05d26e1d0838fa9dff85299673662cfb1002ec
Author: Ivan S. Titov <iohann.s.titov@gmail.com>
Date: Sat May 16 16:40:14 2026 +0200

sci-ml/lemonade: drop 10.3.0

Retention: keep 10.4.0 and 10.5.0.

commit 60240409be5881f9cc774c90b2989fef90f0e191
Author: Ivan S. Titov <iohann.s.titov@gmail.com>
Date: Sat May 16 16:39:14 2026 +0200

sci-ml/lemonade: add 10.5.0

Routine upstream bump. CMakeLists diff against 10.4.0 is the project VERSION string
plus a Linux-irrelevant macOS-arch detection block and a flip of the upstream
BUILD_WEB_APP default (which we explicitly set OFF in src_configure regardless). All
MIN_* external-dep version pins are unchanged, so RDEPEND is untouched. Build-
verified via FEATURES=-xattr ebuild ... merge. The pre-existing VisibleVcsPkg
warning (PROPERTIES="live" + ~amd64 keywords) is inherited from 10.3.0/10.4.0 and is
a separate cleanup pass.

commit 42f033ebaa16d43a4177a7ecad46c9a2ee1ae29d
Author: Ivan S. Titov <iohann.s.titov@gmail.com>
Date: Sun May 10 14:51:38 2026 +0200

sci-ml/lemonade: add 10.4.0

commit 3c36ed055d0afc2bd7e490e1b1102171e397f8b8
Author: Ivan S. Titov <iohann.s.titov@gmail.com>
Date: Wed May 6 21:47:06 2026 +0200

sci-ml/lemonade: new package, add 9999 + 10.3.0

Local AI server: optimized LLM inference on AMD NPU + GPU. C++ server
core (lemond + lemonade CLI + the deprecated lemonade-server shim)
installed under /usr to match lemond's get_resource_path() search
list — /opt prefix doesn't fit because the resolver expects
/opt/share/lemonade-server/, not /opt/lemonade/share/.

Tauri desktop wrapper and the bundled web frontend are disabled at
configure time (BUILD_TAURI_APP=OFF + BUILD_WEB_APP=OFF) for a
server-only build; both can move behind USE flags later.

PROPERTIES=live + RESTRICT=network-sandbox because cpp-httplib and
libwebsockets fall back to FetchContent under default ::gentoo
system deps (cpp-httplib lacks a .pc file; libwebsockets isn't
installed by default in this overlay). The FetchContent-built
libwebsockets.a is dropped from the install image — lemond linked
it statically already, no consumers.

USE=fastflowlm pulls in sci-ml/fastflowlm as the NPU runtime
backend; verified end-to-end (lemond + 'lemonade backends' lists
flm npu installed v0.9.39).