lints: Don't require ostree bits on composefs-native images

[cgwalters-bot]

bootc container lint requires an /ostree -> sysroot/ostree symlink (the
fatal baseimage-root lint) and warns unless ostree's prepare-root.conf
enables composefs (baseimage-composefs). Both are meaningless for images
that are only ever deployed with the composefs backend, and force them to
carry ostree cruft. Of the options discussed in #2256, detecting
/usr/lib/composefs/setup-root-conf.toml (even if empty) is the one that is
actionable now, and it mirrors how prepare-root.conf signals ostree.

So when that file exists, a missing /ostree is accepted and the
prepare-root.conf check is skipped. If /ostree is present anyway it is
still validated, and /sysroot is still required since both backends mount
the physical root there. The lint descriptions, bootc-images.md (which
called the /ostree requirement a bug) and bootc-setup-root-conf.toml(5)
now describe the file as the composefs-native marker.

Testing: extended the baseimage-root unit test to cover a composefs-native
image without /ostree, with a bogus /ostree directory, and without
/sysroot, and the baseimage-composefs test to cover a composefs-native
image whose prepare-root.conf disables composefs. On a 16-core RHEL 10
devspace, rebased on current main: cargo test -p bootc-lib (271
passed, the same count as main since existing tests were extended) and just validate passed.

CI note (2026-09-24): the test-integration (fedora-44, composefs, ext4, grub, bls, unsealed) failure is unrelated to this change: the container test install config failed with Loading configuration: No such file or directory, a race with the concurrently running printconfig --all test, which creates and deletes /run/bootc/install/10-test.toml while print-configuration scans that directory. The same leg passed on other PRs with the same base. Failed jobs will be rerun once the run completes.

bootc requires DCO: the commits have no Signed-off-by, so a maintainer must sign off before merging (e.g. git rebase --signoff <base> and force-push).

Closes: #2256

The Signed-off-by: Colin Walters <walters@verbum.org> on these commits was added on cgwalters's approval of the review draft: cgwalters-forge#4 (review)

Generated-by: https://github.com/cgwalters/#llms

[cgwalters]

CI failure seems legit

[cgwalters-bot]

The failure was a real bug, but in the tests rather than in this change: printconfig --all writes and deletes /run/bootc/install/10-test.toml while install config runs bootc install print-configuration in parallel, and a drop-in that vanishes between the directory scan and the read fails with Loading configuration: No such file or directory. The same failure hit an unrelated PR branch (install-read-ssh-keys-before-mounts, centos-9 ostree) (job). On a devspace, 12 parallel loops of those two tests on this PR's image hit it 5 times in 18000 runs.

Fixed in a new commit on top, aec657d "tests-integration: Fix race between the install config tests", which merges the two into one test. Your lint commit is unchanged, but the new commit has no sign-off yet, so it needs your re-approval.

Tested on a 16-core devspace: the same stress loop on the fixed image had 0 failures in 18000 runs; just validate, just unit-tests, and for fedora-44 composefs ext4 systemd uki sealed, the container integration tests plus the tmt plans readonly and image-upgrade-reboot all passed.

Generated-by: https://github.com/cgwalters/#llms

[cgwalters-bot]

Rebased onto main; 2 commits, no content change.

Generated-by: https://github.com/cgwalters/#llms