Require a local RedoxFS module for GRUB builds

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

local/docs/GRUB-INTEGRATION-PLAN.md

@@ -84,7 +84,12 @@ The standalone EFI image includes these modules:
 
 Note: `chainloader` is a built-in command in GRUB 2.12 (no separate module needed).
 
-No RedoxFS module is needed — GRUB chainloads the Redox bootloader instead.
+Red Bear policy now requires a local `redoxfs.mod` artifact for GRUB builds.
+The GRUB recipe resolves it in this order:
+1. `local/recipes/core/grub/modules/redoxfs.mod`
+2. `${COOKBOOK_SYSROOT}/usr/lib/grub/x86_64-efi/redoxfs.mod`
+
+If neither exists, the GRUB recipe fails fast.
 
 ## GRUB Configuration
 
@@ -188,6 +193,7 @@ This approach requires **no changes to the installer** and works immediately.
 |------|---------|
 | `local/recipes/core/grub/recipe.toml` | Build GRUB from source, produce `grub.efi` |
 | `local/recipes/core/grub/grub.cfg` | Default GRUB configuration |
+| `local/recipes/core/grub/modules/redoxfs.mod` | Mandatory local GRUB RedoxFS module artifact |
 | `local/scripts/install-grub.sh` | Post-build ESP modification script |
 | `local/scripts/fat_tool.py` | Python FAT32 tool (no mtools dependency) |
 | `recipes/core/grub → local/recipes/core/grub` | Symlink for recipe discovery |

local/recipes/core/grub/modules/.gitkeep

@@ -0,0 +1 @@
+

local/recipes/core/grub/recipe.toml

@@ -5,6 +5,7 @@
 # The resulting grub.efi chainloads the Redox bootloader.
 #
 # Output: /usr/lib/boot/grub.efi, /usr/lib/boot/grub.cfg
+# Required local module: local/recipes/core/grub/modules/redoxfs.mod
 #
 # Build: make r.grub
 # Install into image (Phase 1):  ./local/scripts/install-grub.sh build/x86_64/harddrive.img
@@ -85,32 +86,80 @@ fi
 
 echo "Found GRUB modules in: ${MOD_DIR}"
 
-# Build standalone EFI image with curated module set.
+# Build standalone EFI image with a broad module set.
 # -O x86_64-efi: output format
 # -d MOD_DIR: module search directory
 # -p /EFI/BOOT: prefix for GRUB config search path
 # The resulting image is self-contained (no external module files needed).
+
+has_mod() {
+    local name="$1"
+    [ -f "${MOD_DIR}/${name}.mod" ]
+}
+
+add_mod() {
+    local name="$1"
+    if has_mod "${name}"; then
+        SELECTED_MODULES+=("${name}")
+    else
+        echo "WARN: GRUB module not found, skipping: ${name}" >&2
+    fi
+}
+
+# Keep this list broad for first-class multi-filesystem support.
+# Missing modules are skipped with a warning so builds stay resilient.
+SELECTED_MODULES=()
+for m in \
+    part_gpt part_msdos \
+    normal configfile search search_fs_uuid search_label \
+    echo test ls cat halt reboot chain \
+    fat ext2 btrfs xfs jfs reiserfs udf iso9660 ntfs ntfscomp hfs hfsplus zfs \
+    gzio xzio lzopio lzma; do
+    add_mod "${m}"
+done
+
+# RedoxFS module is mandatory for Red Bear GRUB first-class support.
+# Prefer local tree artifact, then fall back to staged sysroot copy.
+REDOXFS_MOD_CANDIDATES=(
+    "${COOKBOOK_RECIPE}/modules/redoxfs.mod"
+    "${COOKBOOK_SYSROOT}/usr/lib/grub/x86_64-efi/redoxfs.mod"
+)
+
+REDOXFS_MOD=""
+for cand in "${REDOXFS_MOD_CANDIDATES[@]}"; do
+    if [ -f "${cand}" ]; then
+        REDOXFS_MOD="${cand}"
+        break
+    fi
+done
+
+if [ -z "${REDOXFS_MOD}" ]; then
+    echo "ERROR: redoxfs.mod not found." >&2
+    echo "Expected one of:" >&2
+    for cand in "${REDOXFS_MOD_CANDIDATES[@]}"; do
+        echo "  - ${cand}" >&2
+    done
+    exit 1
+fi
+
+cp "${REDOXFS_MOD}" "${MOD_DIR}/redoxfs.mod"
+echo "Using mandatory RedoxFS GRUB module: ${REDOXFS_MOD}"
+if ! printf '%s\n' "${SELECTED_MODULES[@]}" | grep -qx "redoxfs"; then
+    SELECTED_MODULES+=("redoxfs")
+fi
+
+if [ "${#SELECTED_MODULES[@]}" -eq 0 ]; then
+    echo "ERROR: No GRUB modules selected for grub-mkimage" >&2
+    exit 1
+fi
+
 echo "Creating standalone GRUB EFI image..."
 ./grub-mkimage \
     -O x86_64-efi \
     -d "${MOD_DIR}" \
     -o "${COOKBOOK_STAGE}/usr/lib/boot/grub.efi" \
     -p /EFI/BOOT \
-    part_gpt \
+    "${SELECTED_MODULES[@]}" || exit 1
-    part_msdos \
-    fat \
-    ext2 \
-    normal \
-    configfile \
-    search \
-    search_fs_uuid \
-    search_label \
-    echo \
-    test \
-    ls \
-    cat \
-    halt \
-    reboot || exit 1
 
 # Verify output
 if [ ! -f "${COOKBOOK_STAGE}/usr/lib/boot/grub.efi" ]; then