feat(packaging/bazzite): systemd-sysext replaces rpm-ostree layering as the primary install path

Layering is a last resort per the Bazzite docs (slows every OS update, can
block upgrades until removed); a sysext never enters an rpm-ostree
transaction, survives OS updates, and installs/updates with no reboot —
the mechanism Fedora Atomic ships via fedora-sysexts.

- build-sysext.sh wraps the built host+web RPMs into punktfunk-<V-R>-x86-64.raw:
  /etc payload relocated to /usr/share/punktfunk/etc (a sysext carries only
  /usr), the punktfunk-sysext helper embedded, ID=fedora + VERSION_ID pinned
  (merges on Bazzite via ID_LIKE; REFUSED after a major rebase instead of
  running soname-broken binaries — both behaviors validated live on Bazzite 43).
  SELinux labels are baked in as squashfs pseudo-xattrs from matchpathcon:
  unlabeled files run fine for user units but system daemons are DENIED
  (udev couldn't read the gamepad rule under enforcing) — validated on-glass.
  Refuses duplicate input package names (a stale noarch punktfunk-web next to
  the x86_64 one built a chimera image with the dead node launcher once).
- punktfunk-sysext.sh: install/update/status/remove against per-Fedora-major
  feeds (…/generic/punktfunk-sysext/f43[-canary]), SHA-256-verified, applies
  the udev/sysctl scriptlet work + /etc copies, prints the layering-migration
  hint. Live-validated on the .41 Bazzite box incl. service restart + web console.
- publish-sysext-feed.sh + rpm.yml: build + publish the image per matrix leg
  (fedver 43/44), canary feeds pruned to 6, stable release assets attached.
- update-punktfunk.sh warns when the sysext shadows a layered install.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

packaging/bazzite/update-punktfunk.sh

@@ -23,6 +23,14 @@ if [[ $EUID -ne 0 ]]; then
   exit 1
 fi
 
+# The sysext path (packaging/bazzite/punktfunk-sysext.sh) supersedes layering entirely — if the
+# box runs the sysext, it shadows any layered copy and THIS script won't change what executes.
+if [[ -f /var/lib/extensions/punktfunk.raw ]]; then
+  echo "NOTE: the punktfunk sysext is installed — update with 'punktfunk-sysext update' instead." >&2
+  echo "      (a layered punktfunk is shadowed by the sysext; consider removing the layer:" >&2
+  echo "       rpm-ostree uninstall punktfunk punktfunk-web)" >&2
+fi
+
 # Which punktfunk packages are actually layered right now (host, web, or both).
 mapfile -t layered < <(rpm-ostree status --json 2>/dev/null \
   | grep -oE '"punktfunk(-web)?"' | tr -d '"' | sort -u)