[ci-robbot]

Part of #4966

Summary

01323bd5 reverted the whole GRUB live media chain because of one commit in
it, de2579bf, which moved hello.sh out of /usr/local/bin on the premise
that a sysext cannot merge there. That premise is wrong, and the revert message
is right about why: 99_sysext.yaml lists /usr/local/bin in
SYSTEMD_SYSEXT_HIERARCHIES on both the UKI and the GRUB drop-in, and
uki_test.go has been asserting a merge there for a while.

The cause of the original red was a different commit in the same chain,
1ee2586d, and reverting the chain threw that fix away too. Before it,
tests/assets/sysext was baked onto every ISO, and its work.sysext.raw is
verity and signed with tests/assets/keys/db.key. Only a UKI cell enrols
the matching certificate; the whole test-core matrix runs secureboot: false.
So on a plain GRUB cell dm-verity setup fails:

device-mapper: table: 252:0: verity: Root hash verification failed (-ENOKEY)

and that is a hard return out of merge_subprocess in systemd's
src/sysext/sysext.c, not the n_ignored++; continue; an incompatible image
gets. One such image therefore costs the machine every other extension, which
is how an unrelated spec, test-core / bundles, went red (#5004).

This restores the chain without de2579bf:

• tests/assets/sysext splits into sysext-uki (verity and signed) and
  sysext-grub (verity only, no signature partition, same hello.sh payload
  in /usr/local/bin).
• _build-iso.yaml picks the directory from trusted_boot, behind a
  test_sysext_overlay opt-in that defaults to false, and release.yaml pins
  it false at every caller, so a shipped ISO carries neither.
• tests/sysext_live_media_test.go comes back as the sysext cell of the
  test-core matrix, asserting the extension reaches
  /var/lib/kairos/extensions, is enabled for the booted state, is linked into
  /run/extensions, is merged into /usr/local/bin and runs.

immucore/pkg/state/verity_signature_internal_test.go arrived in #4989 after
the revert, so its assets constant pointed at the merged directory. It now
points at sysext-uki, where the signed asset lives, and gains two cases that
read the GRUB asset: #4989 skips both an image that fails the policy and a
signed image on a boot with no certificates, so the GRUB media has to carry an
extension that check keeps or the sweep has nothing left to merge.

hello-broke.sysext.raw stays off the GRUB overlay. Since #4989 immucore would
drop it before systemd-sysext refresh saw it, so asserting on it is a test of
that filter and belongs in a spec about the filter, not in this one.

How it was tested

• go test ./immucore/pkg/state/... passes, including the three new cases that
  read tests/assets/sysext-grub/work.sysext.raw and assert it carries no
  verity signature and is kept on a GRUB boot.
• go vet ./immucore/... and go vet ./... in the tests module are clean, so
  the restored spec still compiles against current master.
• Every workflow hunk and both asset directories are byte identical to the
  state at caacbc85, which passed yamllint and actionlint in CI before the
  revert. git rev-parse was used to confirm the restored blobs match
  1ee2586d and caacbc85 exactly, and that sysext-grub/work.sysext.raw is
  the pre-de2579bf image.

Not tested in a boot. There is no QEMU, no /dev/kvm and no docker in the
environment this was written in, so CI is the reproduction. The revert asked
for the next attempt to start from a real local reproduction and I cannot
provide one. What I can say is that this isolates the question to a single
variable: with de2579bf left out, the GRUB extension merges /usr/local/bin
again. If test-core / install reds on the edgevpn bundle it declares with
rootfs_path: /usr/local/bin (tests/install_test.go:173), that red is the
reproduction, and de2579bf's observation was right even though its stated
cause was not. If it stays green, the revert's objection is settled and the
coverage is back.

AI was used to write this change. No human has read it yet.