ha: replace the HAOS VM with a native Podman Quadlet container

The fixed 2 GiB ha_van allocation starved the 4 GB Pi. HA Container now
runs on the host network (http://10.42.0.1:8123): ha/homeassistant.container
installs to /etc/containers/systemd/, config in /srv/homeassistant, host
D-Bus mounted for onboard Bluetooth (needs apparmor=unconfined — Ubuntu's
dbus-daemon mediates per AppArmor label and denies AddMatch to BlueZ —
plus NET_ADMIN/NET_RAW for habluetooth adapter recovery).

Drop the VM-era plumbing: the 10.42.0.50 dhcp-host pin becomes a
host-record for 10.42.0.1, and the legacy-URL DNAT + hairpin masquerade
go away entirely. ha_van.xml retired to git history.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

ha/ha_van.xml

@@ -1,61 +0,0 @@
-<!-- Home Assistant OS VM — aarch64 port for the Pi 4 "wan" host.
-     Same identity as wayback's x86 ha_van: MAC 52:54:00:ad:0a:01 is pinned to
-     10.42.0.50/"homeassistant" by van-ap-dnsmasq. 2 GiB RAM (Pi has 3.7 total),
-     machine=virt + AAVMF EFI, virtio disk/net. Fresh 18.1 install, configured
-     from scratch (a backup-restore from the x86 instance left Core stopped and
-     Supervisor idle; the old config was minimal, so it was abandoned).
-     VNC graphics + virtio-gpu: the HAOS CLI lives on the graphical console
-     (its serial console runs no getty), so this is the only way in without
-     SSH add-ons — view it via Cockpit's Virtual Machines page. -->
-<domain type='kvm'>
-  <name>ha_van</name>
-  <uuid>af014c94-de20-4f52-8d6b-438f16cd82e6</uuid>
-  <description>Home Assistant OS (aarch64)</description>
-  <memory unit='KiB'>2097152</memory>
-  <currentMemory unit='KiB'>2097152</currentMemory>
-  <vcpu placement='static'>2</vcpu>
-  <os firmware='efi'>
-    <type arch='aarch64' machine='virt'>hvm</type>
-    <firmware>
-      <feature enabled='no' name='enrolled-keys'/>
-      <feature enabled='no' name='secure-boot'/>
-    </firmware>
-    <boot dev='hd'/>
-  </os>
-  <features>
-    <gic version='2'/>
-  </features>
-  <cpu mode='host-passthrough' check='none'/>
-  <clock offset='utc'/>
-  <on_poweroff>destroy</on_poweroff>
-  <on_reboot>restart</on_reboot>
-  <on_crash>destroy</on_crash>
-  <devices>
-    <emulator>/usr/bin/qemu-system-aarch64</emulator>
-    <disk type='file' device='disk'>
-      <driver name='qemu' type='qcow2' discard='unmap'/>
-      <source file='/var/lib/libvirt/images/haos_generic-aarch64-18.1.qcow2'/>
-      <target dev='sda' bus='scsi'/>
-    </disk>
-    <controller type='scsi' index='0' model='virtio-scsi'/>
-    <interface type='bridge'>
-      <mac address='52:54:00:ad:0a:01'/>
-      <source bridge='br0'/>
-      <model type='virtio'/>
-    </interface>
-    <serial type='pty'>
-      <target type='system-serial' port='0'/>
-    </serial>
-    <console type='pty'>
-      <target type='serial' port='0'/>
-    </console>
-    <graphics type='vnc' port='-1' listen='127.0.0.1'/>
-    <video>
-      <model type='virtio'/>
-    </video>
-    <rng model='virtio'>
-      <backend model='random'>/dev/urandom</backend>
-    </rng>
-    <memballoon model='virtio'/>
-  </devices>
-</domain>

ha/homeassistant.container

@@ -0,0 +1,34 @@
+# Home Assistant Container as a Podman Quadlet (replaced the ha_van HAOS VM
+# 2026-07-07 — the fixed 2 GiB VM allocation starved the 4 GB Pi; VM domain XML
+# is in git history under ha/ha_van.xml). Installed by deploy.sh to
+# /etc/containers/systemd/; systemd generates homeassistant.service from it.
+#
+# Host networking: HA binds :8123 on the host directly, so the LAN URL is
+# http://10.42.0.1:8123 (name: homeassistant) — no bridge port, no DNAT.
+# /run/dbus gives HA the host BlueZ stack = the Pi's onboard Bluetooth (hci0).
+[Unit]
+Description=Home Assistant (Podman container)
+Wants=network-online.target bluetooth.service
+After=network-online.target bluetooth.service
+
+[Container]
+Image=ghcr.io/home-assistant/home-assistant:stable
+ContainerName=homeassistant
+Network=host
+Volume=/srv/homeassistant:/config
+Volume=/run/dbus:/run/dbus:ro
+Environment=TZ=America/Toronto
+# Bluetooth needs two escapes: Ubuntu's dbus-daemon mediates D-Bus per
+# AppArmor label and the default containers profile can't send to BlueZ
+# (AddMatch denied), and habluetooth wants NET_ADMIN+NET_RAW for adapter
+# recovery. HA is rootful + host-net anyway.
+PodmanArgs=--security-opt apparmor=unconfined
+AddCapability=NET_ADMIN NET_RAW
+
+[Service]
+Restart=always
+# First start pulls the image (~600 MB) — allow for a slow uplink.
+TimeoutStartSec=900
+
+[Install]
+WantedBy=multi-user.target