tests: Fix install-outside-container for composefs+grub

The initial change to use locally-built images had two additional issues
on composefs:

1. containers-storage: transport fails on composefs's read-only root
   with "mkdir /.local: read-only file system". Fix by exporting the
   image to an OCI layout directory on writable /var/tmp instead.

2. run_install() was masking /sysroot/ostree and removing bootupd update
   metadata, which composefs needs for bootloader installation and boot
   binaries. Fix by making run_install() skip these ostree-specific
   workarounds on composefs systems.

Note: the composefs install-outside-container code path still has a
separate bug ("Shared boot binaries not found" in boot.rs:745) that
needs fixing in the Rust code.

Assisted-by: Claude Code (Opus 4)
Signed-off-by: ckyrouac <ckyrouac@redhat.com>

Author: ckyrouac

tmt/tests/booted/tap.nu

@@ -55,12 +55,21 @@ export def get_target_image [] {
 
 # Run a bootc install command in an isolated mount namespace.
 # This handles the common setup needed for install tests run outside a container.
+# For ostree: masks off bootupd updates and /sysroot/ostree to reproduce
+# https://github.com/bootc-dev/bootc/issues/1778
+# For composefs: only removes bound images (bootupd metadata and boot
+# binaries under /sysroot/ostree are needed for installation).
 export def run_install [cmd: string] {
+    let is_cfs = (is_composefs)
+    let mask_cmds = if $is_cfs {
+        "true"
+    } else {
+        "if test -d /sysroot/ostree; then mount --bind /usr/share/empty /sysroot/ostree; fi\nrm -vrf /usr/lib/bootupd/updates"
+    }
     systemd-run -p MountFlags=slave -qdPG -- /bin/sh -c $"
 set -xeuo pipefail
 bootc usr-overlay
-if test -d /sysroot/ostree; then mount --bind /usr/share/empty /sysroot/ostree; fi
-rm -vrf /usr/lib/bootupd/updates
+($mask_cmds)
 rm -vrf /usr/lib/bootc/bound-images.d
 ($cmd)
 "

tmt/tests/booted/test-install-outside-container.nu

@@ -7,9 +7,12 @@ use std assert
 use tap.nu
 
 # Use the locally-built image which has updated bootupd with compatible
-# EFI update metadata, matching the pattern used by test-32/37/38.
+# EFI update metadata. Export to OCI layout on a writable path since
+# containers-storage: transport can't work when the root fs is read-only
+# (composefs), and install-outside-container tests run directly on the host.
 bootc image copy-to-storage
-let target_image = "containers-storage:localhost/bootc"
+skopeo copy containers-storage:localhost/bootc oci:/var/tmp/bootc-oci
+let target_image = "oci:/var/tmp/bootc-oci"
 
 # setup filesystem
 mkdir /var/mnt
@@ -22,9 +25,6 @@ let result = bootc install to-filesystem /var/mnt e>| find "--source-imgref must
 assert not equal $result null
 umount /var/mnt
 
-# Mask off the bootupd state to reproduce https://github.com/bootc-dev/bootc/issues/1778
-# Also it turns out that installation outside of containers dies due to `error: Multiple commit objects found`
-# so we mask off /sysroot/ostree
 # And using systemd-run here breaks our install_t so we disable SELinux enforcement
 setenforce 0