ci: Cover composefs upgrade paths (Fedora 44 upgrade, 1.16 bridge, btrfs)

[cgwalters-bot]

CI didn't cover several composefs upgrade paths. This closes three of those gaps.

• Fedora 44 composefs upgrade: re-enabled. It was excluded (bb674f1) because the Fedora 44 base image's bootc hit the pull-then-GC deadlock from [Composefs-native backend] bootc update/switch hangs after completing the staging process bootc-dev/bootc#2364. That was fixed in 1.16.8, and fedora-bootc:44 now ships 1.16.10.
• test-49 (1.16.0 UKI bridge): it needed hand-built fixture images, so nothing ran it. just test-composefs-bridge sealed|unsealed now builds them from the tree. The stager is the current UKI image with bootc swapped for the pinned 1.16.0 Koji RPM (checksum verified; the version-locked bootc-tests and system-reinstall-bootc are removed first, so the downgrade still gets dependency checks), and its initramfs and UKI are regenerated by 1.16.0. The target fails early unless the base is Fedora on x86_64. A new test-composefs-bridge job runs both modes on Fedora 44. It runs with the heavy jobs instead of nightly: it takes less time than an existing sealed UKI leg, and there is no scheduled CI workflow whose failures anyone would see.
• btrfs: one Fedora 44 composefs leg (sealed UKI, systemd-boot) running the same plans as the other sealed legs. It is added through a computed include, so it doesn't multiply the matrix.

Cost (full-suite runs only; ci/tier-1 adds nothing): 4 more jobs, next to about 19 test-integration legs. From a recent merge-queue run: an upgrade leg takes about 20 min, and a sealed UKI integration leg about 50 min, which the btrfs leg should match. Each bridge leg is one build plus one 4-boot VM run: 24 min on a devspace, including the package build.

Tested on RHEL 10 devspaces, following the CI job steps (just build-fetch and the same just targets):

• just test-upgrade with Fedora 44 and composefs: passed (booted 1.16.10, upgraded, readonly suite);
• just test-composefs-bridge unsealed and sealed: 1.16.0 install (the test checked the binary's checksum), then switch, upgrade, rollback and composefs-gc --assert-no-op, all passed;
• just test-composefs systemd btrfs uki sealed: passed (plan-01-readonly and plan-24-image-upgrade-reboot, installed on btrfs);
• after the review fixes (stager downgrade without --nodeps, Fedora/x86_64 check, empty label context), just test-composefs-bridge unsealed and sealed passed again at this head;
• actionlint: the new job only gets the same notes the existing jobs already have (unknown ubuntu-26.04 label, SC2129 style).

This backs the upgrade and btrfs claims in the composefs stabilization work (following bootc-dev#2483): once it lands, its limitations text no longer needs to say that btrfs is untested or that the bridge test and the Fedora 44 upgrade are not in CI.

Generated-by: https://github.com/cgwalters/#llms

---

Review draft in cgwalters-forge, not upstream yet. This section is removed when the PR is opened upstream.

• Upstream: bootc-dev/bootc, base main
• Board item: PVTI_lADOE9oHIs4BlJLczg9kESE
• Fork CI: off; the devspace testing described above is this PR's CI, and upstream CI runs once it is opened there

To review:

• Approve, or comment /promote on a line of its own, to open it upstream, ready for review. Either covers only the commits pushed so far.
• If upstream requires DCO, approving also signs off: promote adds Signed-off-by: Colin Walters <walters@verbum.org> to the commits lacking it (the bot's and yours; anyone else's only if you ask), with you as committer.
• Add a /draft line (in the same comment or before) to open it upstream as a draft (/ready undoes that).
• Close to drop it.
• Edit the title and description freely: they become the upstream PR's. Review comments are squashed into the commits they concern, with a reply here.

[cgwalters-bot]

Heads-up: on current upstream main this PR's 1.16 stager fixture fails at install ("Failed to find ostree/prepare-root.conf in /usr/lib or /etc"). Upstream 0c2f487 drops prepare-root.conf from composefs test images, and bootc 1.16's install requires it. #30, rebased, carries this fix squashed into this PR's "tests: Build the 1.16 bridge fixtures" commit (354c29b on bot/cfs-bridge-1164). This branch still needs the same fix when it's next rebased.

Generated-by: https://github.com/cgwalters/#llms

[cgwalters-bot]

❌ dispatch handed back no result because required data was missing. Its reason:

Authorization for protected workflow-path replacement: PR #18's required complete replacement series includes protected .github/workflows/ci.yml; current handback rules prohibit delivering those commits. The requested blocker add_comment is also not an allowed output.
context: Checkout unchanged. No VERDICT review or failing required checks exist. The existing PR comment identifies the 1.16 stager prepare-root.conf regression and points to fork PR #30's correction. Fork main already equals the series base.
alternatives: Authorize workflow-path replacement and a PR-comment output in a new run, or refresh the series manually and post the blocker on the PR. No push or replacement requested.