fix: export OCI from redirected podman storage

[hanthor]

Fixes the installer failure observed in wootc Phase 2: the image pull succeeds into redirected, disk-backed Podman storage, but OCI export must address that exact store.

• keep an explicit graph root and run root together for the redirected Podman pull and subsequent OCI-backed container run
• preserve the fully qualified containers-storage:[driver@graphroot+runroot] source when invoking Skopeo
• only redirect storage when the default store is RAM-backed

Validated by a focused installer regression test. The full installer suite is environment-blocked here because the SELinux preload test cannot map its shared object from the local noexec temporary filesystem; Kanpur E2E is the integration validation.

[hanthor]

Thanks for the detailed writeup — the containers-storage:[driver@graphroot+runroot] qualification and the containersStorageSource helper are the right shape, and the new internal test covers it well.

Blocking issue: the unit-tests CI job fails on the changed package, and at least one failure is diff-caused rather than environmental:

--- FAIL: TestBootcInstall_NonComposefsContainerExportsOCI
    bootc_test.go:582: SkopeoExportOCIFn was not called for non-composefs
        container mode with SourceImgref set

This looks like a direct consequence of the new gate in bootc.go:

if !opts.ComposeFsBackend && defaultStorageSpaceConstrained() {

Previously the non-composefs path always set nonComposefsRoot, so useOciLayout was true and the OCI export (SkopeoExportOCIFn) ran. Now the export only happens when the default store is RAM-backed. In the unit-test environment that predicate is false, so useOciLayout stays false and Skopeo is never invoked — which is exactly what the test now reports. Please either update TestBootcInstall_NonComposefsContainerExportsOCI to reflect the new space-constrained gating (and inject/stub defaultStorageSpaceConstrained), or reconcile the implementation with the expected behavior.

Secondary, please double-check:

• TestSelectStorageDriver_NonComposefs (driver = "overlay", want vfs) — this one may be environmental (the CI runner's /tmp supporting an overlay probe), but it's failing on this run, so worth confirming it's not a real behavior change.
• Lint reports two items in the file you touched: bootc.go:892 ((*os/exec.Cmd).Run errcheck) and bootc.go:820 (writeStorageConfWithTmpDir unused). The other nilerr/gofmt findings are in post/ and slurp/ files this PR doesn't touch and look pre-existing/systemic. There's also a stray double blank line introduced around the storageDriver = nonComposefsDriver block.

Kanpur E2E as the integration signal is reasonable, but the unit suite needs to be green (or updated) before merge.

[hanthor]

Merged current dev into this branch to clear a merge conflict — it was blocking, and this PR looks like the fix for a failure now visible in CI.

The conflict was formatting only. One hunk in bootc.go, where this branch differed from its merge base by a single blank line while dev had the block de-indented by gofmt -s (#14). Since this PR made no semantic change there, dev's formatting wins and neither side loses anything.

Why this became urgent. #14 fixed lint and unit-tests, which had been red on dev and were causing the whole VM matrix to be skipped on every run. With them green the matrix finally executed, and every job failed with exactly what this PR describes:

level=fatal msg="initializing source containers-storage:[overlay@/var/lib/containers/storage+/run/containers/storage]
  ghcr.io/tuna-os/fisherman/centos-bootc:ssh-enabled: reference ... does not resolve to an image ID"
fisherman: fatal: bootc install: exporting image to OCI layout: skopeo copy: exit status 1

That is the qualified containers-storage:[driver@graphroot+runroot] reference not resolving in the store the image actually landed in — the precise problem in this PR's description. So the E2E validation you noted you couldn't run locally should now be available on this branch.

On the two failing unit tests, so they are not misattributed to the merge: TestBuildSelinuxBypassShim_InterceptsSecuritySelinux and TestBootcInstall_NonComposefsContainerExportsOCI fail identically on the pristine pre-merge branch and on unmodified dev on my machine — and both pass on your runners. Environment-dependent locally, not introduced here. Your own note about the SELinux preload test being unable to map its shared object from a noexec tmpfs matches exactly what I see.

No behaviour from this PR was touched; only the conflicting whitespace hunk.

[hanthor]

Not merging this — it now has a real, visible regression, and I would rather surface it than paper over it.

With dev green (#14), CI is finally readable, and this branch fails unit-tests where dev passes:

--- FAIL: TestBootcInstall_NonComposefsContainerExportsOCI
    bootc_test.go:582: SkopeoExportOCIFn was not called for
                       non-composefs container mode with SourceImgref set

That is a CI-to-CI comparison — dev passes this test on the same runners, this branch does not — so it is caused by this change rather than by the environment. (Worth separating from the noise: this same test also fails on my machine against unmodified dev, which is a different, local-only problem. The signal here is the CI delta.)

Why it fails, and why it is a design question rather than a test bug

The test asserts that for non-composefs container mode with SourceImgref set, the OCI export runs. This PR makes the storage redirect conditional — "only redirect storage when the default store is RAM-backed" — so on a runner whose default containers store is disk-backed, no redirect happens, no export fires, and exportCalled stays false.

So one of two things is true, and only you can say which:

1. The narrowed condition is too narrow — the export should still happen for this case, and the PR needs adjusting; or
2. The condition is correct and the test is now stale — it encodes an assumption this PR deliberately changes, and should be updated to match.

I have deliberately not picked. Editing your test to match your PR would make that call for you, and if (1) is the truth it would convert a caught regression into a silent one — in a code path where "the OCI export did not happen" is precisely the failure this PR exists to fix.

Context that may help decide

The E2E matrix failure I mentioned above is still unfixed and still looks like this PR's territory:

containers-storage:[overlay@/var/lib/containers/storage+/run/containers/storage]
  ghcr.io/tuna-os/fisherman/centos-bootc:ssh-enabled: does not resolve to an image ID

Note that the E2E environment is the qualified-store case, and the failing unit test is the disk-backed default store case. If the redirect is being skipped in the disk-backed case, that may be the same decision producing both symptoms — which would point at (1).

The merge of dev into this branch is still fine to keep either way: it resolved a whitespace-only conflict and touched no behaviour.