ci: add bubblewrap dep and bump mkosi to v25.3

v24.3 crashed in cp_version() during the copy-package-manager-trees
step because its sandbox needs bubblewrap (not present in the runner
apt list), and cp --version returned empty output inside the broken
sandbox. Installing bubblewrap and bumping to v25.3 which has tighter
sandbox fallback behavior.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/workflows/e2e.yml

@@ -37,14 +37,14 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends \
             debootstrap squashfs-tools \
-            systemd-ukify systemd-boot kmod \
+            systemd-ukify systemd-boot kmod bubblewrap \
             debian-archive-keyring python3-pip git zstd \
             qemu-system-x86 qemu-utils \
             dnsmasq iperf3 ipxe-qemu
           # See release.yml for rationale — Ubuntu's apt mkosi is too old
           # to handle bookworm's non-free-firmware component correctly.
           sudo pip install --break-system-packages \
-            "git+https://github.com/systemd/mkosi.git@v24.3"
+            "git+https://github.com/systemd/mkosi.git@v25.3"
 
       - name: Install templ
         run: go install github.com/a-h/templ/cmd/templ@v0.3.1001