Regenerate CA trust on first boot and after updates

Locally regenerated CA bundles under /etc survive image updates and can retain vendor CAs that the new image has removed. Add atomic-update-ca-trust.service to the minimal image, which minimal-plus, standard, ELN and IoT inherit, so the host bundles are refreshed from the current vendor sources and the local trust and distrust configuration on first boot and on the first boot after each new deployment.

The service uses ConditionNeedsUpdate=/etc (ostree removes /etc/.updated when it deploys) and is ordered before systemd-update-done.service, systemd-resolved.service and sysinit.target. Local edits to the trust sources still require running update-ca-trust by hand, as on any other system. The service is skipped when coreos-update-ca-trust.service is present, since update-ca-trust cannot run concurrently; that condition can be dropped once Fedora CoreOS rebases on this image. Regeneration failure is visible as a failed unit and in the journal, while boot continues. This mitigates stale host bundles; consumers that read trust earlier in boot and copies embedded in the initramfs require separate handling.

Add a rootfs check for service enablement in every tier and a disposable-image regression test using generated CAs and TLS server certificates. The test checks stale bundles, vendor additions/removals, preservation and removal of local policy, and repeated refreshes in the PEM and OpenSSL bundles. Wire it into the standard-tier just test path. This is image-level coverage, not a VM deployment or boot-ordering test.

Related: https://forge.fedoraproject.org/atomic/tracker/issues/145

Local validation passed:

• Repository whitespace, ShellCheck, YAML, and shell syntax checks.
• systemd unit verification.
• FEDORA_VERSION=44 just test for the minimal and standard tiers: image builds, rootfs checks, and for standard the CA, derive and sysusers container tests.
• Fedora ELN standard build with the current ELN compose.
• VM validation with bcvk (details in the discussion): first boot, upgrade with local policy, plain reboot, rollback, stale-machine repair, both units present, and a boot-ordering check for TLS-linked services.

Generated-by: AI