VM image: seal the install test's own base image

test/integration already installs the ISO unattended and saves the
installed disk as test-runs/<iso>-integration/base.qcow2, with its
firmware variables and the key that logs in to it. That folder is what
vm-seal takes, so the separate install script goes.

The sealed image now also carries the firmware variables, which hold the
boot entry the installer registered: a consumer that boots the disk
through UEFI needs them, a direct kernel boot does not.

test/vm-image/vm-seal

@@ -1,13 +1,16 @@
 #!/bin/bash
-# Turns an installed Omarchy disk (vm-install) into an image anyone can
+# Turns an installed Omarchy disk (test/integration's base image) into an image anyone can
 # download and boot: every boot is its own machine, nothing of the build is
 # left in it, and it boots straight into its kernel, so a boot takes seconds.
 #
 #   vm-seal <installed_dir> <sealed_dir>
 #
-# installed_dir holds base.qcow2, OVMF_VARS.4m.fd and id_ed25519. sealed_dir
-# gets a standalone, zstd-compressed base.qcow2 and the UKI's vmlinuz, initrd
-# and cmdline. It holds no key: each boot is handed one (see vm-boot).
+# installed_dir holds base.qcow2, OVMF_VARS.4m.fd and id_ed25519, which is
+# what test/integration leaves in test-runs/<iso>-integration once its install
+# has passed. sealed_dir gets a standalone, zstd-compressed base.qcow2, the
+# firmware variables that boot it through UEFI, and the UKI's vmlinuz, initrd
+# and cmdline for booting it directly. It holds no key: each boot is handed
+# one (see vm-boot).
 #
 # The image keeps the installer's user and password (GUEST_PASSWORD, default
 # omarchy) for the desktop and sudo. SSH takes keys only.
@@ -138,5 +141,8 @@ tr -d '\0' <"$state/cmdline" | tr ' ' '\n' | { grep -vE '^(resume|resume_offset)
 
 # zstd clusters: QEMU reads them as they are, so the download boots as it is.
 qemu-img convert -c -O qcow2 -o compression_type=zstd -m 16 -W "$state/edit.qcow2" "$out/base.qcow2"
-( cd "$out" && sha256sum base.qcow2 vmlinuz initrd cmdline >SHA256SUMS )
+# The variables hold the boot entry the installer registered; a firmware boot
+# of this disk needs them, a direct kernel boot does not.
+cp "$in/OVMF_VARS.4m.fd" "$out/OVMF_VARS.4m.fd"
+( cd "$out" && sha256sum base.qcow2 OVMF_VARS.4m.fd vmlinuz initrd cmdline >SHA256SUMS )
 echo "sealed: $out ($(du -sh "$out/base.qcow2" | cut -f1)); cmdline: $(cat "$out/cmdline")"