VM image: seal whichever kernel the system runs

The seal read /boot/EFI/Linux/omarchy_linux-omarchy.efi. An edge install
has linux-omarchy-bore, so the first nightly run stopped there. It now
asks the running system which kernel package it booted and takes that
UKI, and takes the command line from /proc/cmdline, since the boot
entry, not the UKI, may be what holds it. The nightly's package report
names the kernel the same way.

.github/workflows/nightly-build.yml

@@ -110,7 +110,7 @@ jobs:
               base=$(ls -d test-runs/*-integration)
               ./test/vm-image/vm-seal "$base" sealed
               ./test/vm-image/vm-verify sealed | tee vm-verify.txt
-              ./test/vm-image/vm-boot sealed "pacman -Q omarchy-dev omarchy-settings-dev linux-omarchy; uname -r" >vm-packages.txt
+              ./test/vm-image/vm-boot sealed "pacman -Q omarchy-dev omarchy-settings-dev; pacman -Qo /usr/lib/modules/\$(uname -r)/pkgbase; uname -r" >vm-packages.txt
               cat vm-packages.txt
             '