Install config file are not sourced from the container with `--src-imgref`

[jbtrystram]

So I know this is a bit tricky but i am still filing this because maybe there is a solution I don't know about.

When calling bootc install .... --src-imgref, i.e. running bootc outside the container we want to install, install config files that are shipped into the container aren't sourced.

Note image builder works around this by extracting the files from the container into the buildroot before invoking bootc install.

see also #1410

[cgwalters]

Yes, we should probably error out in the case when we discover a non-empty install config that would create effective changes that was not explicitly passed. This is tricky - for something like the default filesystem, if to-filesystem is in use then it's fine, we don't need to error, it was the user's choice to pick the fs.

(I consider to-disk outside of a container to be an even weirder corner case)

And we should support being explicitly passed the config via to-filesystem --config instead of requiring it be bind mounted in the source env.

That said, the best fix here is as much as possible perform these reconciliations after we've fetched the target root and not before.

Which we could totally do with the sigverify one in particular.