feat(ci): gate the size-diff job on UKI .efi sizes

[itxaka-agent]

Automated triage agent (kairos-triage-agent) running as @itxaka-agent.
This comment was generated by software. A human maintainer can override any
action taken here.

Adds a UKI size gate to the existing size-diff CI job.

Today scripts/iso-size-diff.sh only measures the generic (non-UKI) ISO set, and only reports — it never fails the PR. This closes both gaps for UKI artifacts specifically:

• Extracts efiboot.img from every *-uki.iso with xorriso, pulls EFI/kairos/*.efi out with mtools, and measures each .efi.
• Fails the job when a .efi exceeds --max-efi-mib (default 1024 MiB) or grows more than --max-efi-growth-pct (default 10%) against the same file in the last green master build. Both defaults are documented at the top of the script.
• --require-uki fails the job if no UKI ISO is found at all, so a renamed or missing artifact can't pass silently.
• The generic ISO table stays informational, unchanged.

.github/workflows/pr-full.yaml: widened the artifact download pattern (PR and master baseline) to pick up -uki.iso.zip, added xorriso/mtools install steps, and switched the compare step to shell: bash with --require-uki so a failing UKI check isn't swallowed by tee. The gate lives there because after #5269 the default pr.yaml smoke run builds no UKI ISO. pr.yaml only runs the new test script, so that still happens on every PR.

scripts/iso-size-diff_test.sh is new: 14 cases covering pass, ceiling, growth (with and without baseline), --require-uki, mixed generic+UKI sets, and two distinct broken-ISO shapes (missing efiboot.img, and an efiboot.img present but missing EFI/kairos).

Needs a maintainer call: the 1024 MiB / 10% thresholds are my best guess, not a measured number — I had no way to see real UKI sizes from this environment. Check them against the sizes this PR's own CI run reports, and tune DEFAULT_MAX_EFI_MIB / DEFAULT_MAX_EFI_GROWTH_PCT at the top of scripts/iso-size-diff.sh if they're off.

Fixes: #2347

Test run and lint evidence posted in a separate comment below.

[itxaka-agent]

Automated triage agent (kairos-triage-agent) running as @itxaka-agent.
This comment was generated by software. A human maintainer can override any
action taken here.

test run

Ran scripts/iso-size-diff_test.sh locally at commit 1b81b1c7, 2026-10-01T15:40:57+02:00: 14/14 passed.

blob sha: 00605a4c9f1af86041859fd0b7062f265948f896

Also ran, all clean: shellcheck on both scripts, yamllint --strict on .github/workflows/pr.yaml (default rules and the repo's own .yamllint config), actionlint on the same file.

No QEMU verification needed — this change is CI tooling only (bash script + GitHub Actions YAML), no boot/install/upgrade/reset path touched.

[ci-robbot]

Picking this up for QA.

[ci-robbot]

QA Result: PASS

Check	Result
Environment	PR head 1b81b1c7. Real UKI ISOs from this PR's run 36871582383 (kairos-hadron-trusted-v0.5.1-{core,standard}-amd64-generic-uki) and the same two from master run 36722603287, the baseline the PR's own job picked. x86_64 devbox, xorriso and mtools from Ubuntu.
Reproduction	Ran the new "Compare ISO sizes and check UKI sizes" step body under bash --noprofile --norc -eo pipefail, which is what shell: bash runs, piping into tee the same way. Four inputs: A) real PR ISOs vs real master ISOs. B) the real standard UKI ISO repacked with EFI/kairos/norole.efi padded by 13%. C) real ISOs with --max-efi-mib 200. D) input B under the old default shell (bash -e, no pipefail). Also ran scripts/iso-size-diff_test.sh, checked the new artifact glob against all 104 artifact names in the PR run, and read the ESP of the PR standard ISO with mdir on its own.
Expected	Real sizes are measured per .efi and pass. Growth over 10% and a breached ceiling fail the step. BOOTX64.EFI is not gated. The glob picks up the two UKI ISOs and nothing extra.
Actual	A: exit 0. core norole.efi/testentry.efi 150.19 to 150.32 MiB (+0.08%), standard 252.23 to 252.36 MiB (+0.05%), all ok. B: exit 1, norole.efi grew +32.93 MiB (+13.06%), over the 10% limit. C: exit 1, both standard .efi over 200 MiB, core ones ok. D: exit 0, so the shell: bash change is what makes the failure stop the job. mdir shows norole.efi at 264615312 bytes, which is the 252.36 MiB the script reports. The glob matches the 3 generic ISOs plus the 2 -uki ones. The unit test script passes 14/14, and it only needs xorriso and mtools, which the job installs first.
Proofs	Full reports for A, B, C and the ESP listing: https://gist.github.com/ci-robbot/c690327198120f628ef8cf806b1f92f4

Summary: The UKI gate measures the real .efi files in the CI-built UKI ISOs, matches them to the master baseline, and fails the step on both a ceiling breach and growth over 10%. It does this under the same shell and tee pipe the workflow uses.

Notes, not blockers:

• This PR's own iso-size-diff job ran master's copy of the job, because the trigger is pull_request_target. Its log shows the old glob and command and no UKI table. So the gate has not run in CI yet. The first PR after merge is the first real CI run.
• The 1024 MiB default ceiling is about 4x the largest UKI today (252 MiB). The PR asks a maintainer to choose the number. With that default, in practice only the 10% growth check can fail.
• Each .efi read extracts the whole ISO to the runner's disk (up to 538 MiB per ISO, baseline included). That works, but extracting only /efiboot.img would be cheaper.

[Itxaka]

@copilot resolve the merge conflicts in this pull request