docs: Add comprehensive sealed image build documentation
Add detailed documentation for building sealed bootc images, covering both monolithic and modular build workflows. This documentation is derived from upstream bootc tooling and reconciles two approaches:
- tests/build-sealed and Dockerfile.cfsuki (primary idiomatic approach)
- tmt/tests/examples/bootc-uki (alternative with explicit dracut examples)
Key additions:
- Overview of sealed images and how they work
- Step-by-step monolithic multi-stage container build process
- Modular workflow for external signing infrastructure
- Secure Boot key generation examples
- Complete Containerfile examples using both pesign and sbsign
- dracut configuration references
- Installation instructions and complete example references
The documentation clearly notes this is experimental functionality and references the planned bootc-base-imagectl integration (issue #1498). It provides both quick evaluation paths and production-ready workflows that support external signing infrastructure.
Co-Authored-By: Claude noreply@anthropic.com Signed-off-by: John Eckersberg jeckersb@redhat.com