sergio/takana

b3:a07b7b14. Suite completa estática. Fase configure explícita --without-{libbsd,libpam,fcaps}
(libbsd ausente→usa readpassphrase de fábrica; fcaps→setcap falla en sandbox); make LDFLAGS=-all-static
(libtool ignora -static, gotcha util-linux); limpié install de pam.d de aports. Habilita usuarios
reales (antes sólo root).

diff --git a/recipes/incoming-clib/shadow.toml b/recipes/incoming-clib/shadow.toml
new file mode 100644
index 00000000..cd5bd2f8
--- /dev/null
+++ b/recipes/incoming-clib/shadow.toml
@@ -0,0 +1,77 @@
+# Importada de Alpine aports por `hammer import-alpine` (Etapa G). PUNTO DE PARTIDA — pero
+# YA trae los parches de musl de Alpine (lo que un import de nix pierde). Pendiente: el
+# sha256 del tarball (el wrapper lo calcula), y adaptar build/install del shell de abuild.
+name    = "shadow"
+version = "4.18.0"
+
+[source]
+tarball = "https://github.com/shadow-maint/shadow/releases/download/4.18.0/shadow-4.18.0.tar.xz"
+# FIXME sha256: el wrapper lo calcula (Alpine publica sha512). sha512 de Alpine:
+# sha512 = "e724670362949ccb570bb300322eb280c28ad609d631072b8db15a5e6eeba9fb9ac5d3df1df270f8b894235e4995b56c0e8f9aadb34d66bb5cea9b7a4f55e6ce"
+sha256  = "add4604d3bc410344433122a819ee4154b79dd8316a56298c60417e637c07608"
+patches = ["useradd-defaults.patch"]
+
+[build]
+compiler = "zig-cc"
+target   = "x86_64-linux-musl"
+link     = "static"
+flags    = []
+
+[build.phases]
+# fase configure EXPLÍCITA: si la receta no la define, hammer autogenera su propio
+# `./configure --prefix=/usr` (sin nuestros --disable-*) e ignora estos flags.
+# De-Alpinizada: sin PAM (musl trae crypt), sin selinux/audit/acl/attr, estático musl.
+configure = '''
+./configure \
+	--build=$CBUILD \
+	--host=$CHOST \
+	--prefix=/usr \
+	--libdir=/usr/lib \
+	--sysconfdir=/etc \
+	--mandir=/usr/share/man \
+	--localstatedir=/var \
+	--disable-nls \
+	--disable-shared \
+	--enable-static \
+	--disable-account-tools-setuid \
+	--without-libbsd \
+	--without-libpam \
+	--without-audit \
+	--without-selinux \
+	--without-acl \
+	--without-attr \
+	--without-tcb \
+	--with-yescrypt \
+	--without-nscd \
+	--without-fcaps
+'''
+compile = '''
+# libtool se come el `-static` (lo lee como flag de libtool, no de link real).
+# El único camino a binarios musl 100% estáticos es su flag propio `-all-static`.
+make LDFLAGS="-all-static"
+'''
+# de package() de Alpine (traducido $pkgdir→/out), sin los pam.d de aports:
+install = '''
+make DESTDIR="/out" install
+make -C man DESTDIR="/out" install-man || true
+
+cd "/out"
+
+# Avoid conflict with man-pages package.
+rm -f usr/share/man/man3/getspnam.3*
+rm -f usr/share/man/man5/passwd.5*
+
+# /etc/login.defs is not very useful - replace it with an *almost* blank file.
+rm -f etc/login.defs
+echo "USERGROUPS_ENAB yes" > etc/login.defs
+echo "UID_MIN 1000" >> etc/login.defs
+
+# Used e.g. for unprivileged LXC containers.
+install -m644 /dev/null etc/subuid
+install -m644 /dev/null etc/subgid
+'''
+
+# deps de Alpine remapeadas al catálogo canónico. AUSENTES quitadas:
+# linux-pam, libbsd, setcap. Sin fcaps (setcap falla en el sandbox) ⇒ sin libcap.
+[deps]
+build = ["linux-headers"]