ci: add bubblewrap dep and bump mkosi to v25.3

v24.3 crashed in cp_version() during the copy-package-manager-trees
step because its sandbox needs bubblewrap (not present in the runner
apt list), and cp --version returned empty output inside the broken
sandbox. Installing bubblewrap and bumping to v25.3 which has tighter
sandbox fallback behavior.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/workflows/e2e.yml

@@ -37,14 +37,14 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends \
             debootstrap squashfs-tools \
-            systemd-ukify systemd-boot kmod \
+            systemd-ukify systemd-boot kmod bubblewrap \
             debian-archive-keyring python3-pip git zstd \
             qemu-system-x86 qemu-utils \
             dnsmasq iperf3 ipxe-qemu
           # See release.yml for rationale — Ubuntu's apt mkosi is too old
           # to handle bookworm's non-free-firmware component correctly.
           sudo pip install --break-system-packages \
-            "git+https://github.com/systemd/mkosi.git@v24.3"
+            "git+https://github.com/systemd/mkosi.git@v25.3"
 
       - name: Install templ
         run: go install github.com/a-h/templ/cmd/templ@v0.3.1001

.gitea/workflows/release.yml

@@ -34,14 +34,15 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends \
             debootstrap squashfs-tools dosfstools \
-            systemd-ukify systemd-boot kmod \
+            systemd-ukify systemd-boot kmod bubblewrap \
             debian-archive-keyring python3-pip git zstd
           # Ubuntu's apt-packaged mkosi is too old to wire
           # non-free-firmware shorthand through to debootstrap.
           # mkosi isn't published on PyPI under v24+ — install the
-          # pinned tag from upstream git instead.
+          # pinned tag from upstream git instead. bubblewrap provides
+          # the sandbox mkosi uses for its `cp`/chroot plumbing.
           sudo pip install --break-system-packages \
-            "git+https://github.com/systemd/mkosi.git@v24.3"
+            "git+https://github.com/systemd/mkosi.git@v25.3"
 
       - name: Install templ
         run: go install github.com/a-h/templ/cmd/templ@v0.3.1001