Adding custom BLS entry blocks most `bootc` operations

[ComposeFS backend] Series of rebases/updates into bootc rollback breaks bootc (persisting through reboots)

Composefs mismatch when built with buildah Github action, but not when built locally via podman

bootc permission failures with an selinux-confined root session

composefs & UKI: Staging an update, then switching to another image will leave the staged UKI in the ESP

(composefs backend): Linux 7.0.1 fails to boot with error "has no fs-verity digest"

`test-coreos` job is failing

xfs mount failure on rawhide

Handle UKI/Type1 boot entries properly

bootc expects `org.opencontainers.image.version` to be set as a label, not an annotation