live-image: fix firmware so i915 actually loads at boot

Previous attempt (c962d6d) added firmware-linux-nonfree to mkosi.conf,
but the CI bundle was still 63 MB and Tiger Lake wedged on tgl_guc.
Two reasons: (1) firmware-linux-nonfree on bookworm is a thin
metapackage that doesn't include firmware-misc-nonfree, which is where
i915 GuC/HuC blobs actually live; (2) Ubuntu's apt-packaged mkosi is
old enough that Repositories=non-free-firmware shorthand likely isn't
wired through to the debootstrap invocation, so firmware packages
silently miss the bootstrap step entirely.

Changes:
- Enumerate firmware packages explicitly in mkosi.conf (firmware-
  misc-nonfree, firmware-iwlwifi, firmware-realtek, firmware-amd-
  graphics, firmware-intel-sound, intel/amd64-microcode).
- Ship mkosi.sources.d/debian.sources with explicit deb822 so the
  non-free-firmware component is unambiguously available.
- Install mkosi 24.3 via pip in CI instead of apt's older build.
- Pin MODULES=most and COMPRESS=zstd via a tracked initramfs-tools
  config under mkosi.extra/.
- Narrow .gitignore so only the generated agent binary is ignored,
  not the whole mkosi.extra/ tree.
- New check-initrd Makefile target asserts both size (>=150 MB) and
  actual presence of i915/tgl_guc_*.bin inside the built initrd, so
  a silent firmware-drop regression fails the build loudly.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitea/workflows/e2e.yml

@@ -36,11 +36,14 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends \
-            mkosi debootstrap squashfs-tools \
+            debootstrap squashfs-tools \
             systemd-ukify systemd-boot kmod \
-            debian-archive-keyring \
+            debian-archive-keyring python3-pip zstd \
             qemu-system-x86 qemu-utils \
             dnsmasq iperf3 ipxe-qemu
+          # See release.yml for rationale — Ubuntu's apt mkosi is too old
+          # to handle bookworm's non-free-firmware component correctly.
+          sudo pip install --break-system-packages mkosi==24.3
 
       - name: Install templ
         run: go install github.com/a-h/templ/cmd/templ@v0.3.1001

.gitea/workflows/release.yml

@@ -33,9 +33,14 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get install -y --no-install-recommends \
-            mkosi debootstrap squashfs-tools dosfstools \
+            debootstrap squashfs-tools dosfstools \
             systemd-ukify systemd-boot kmod \
-            debian-archive-keyring
+            debian-archive-keyring python3-pip zstd
+          # Ubuntu's apt-packaged mkosi is too old to wire
+          # non-free-firmware shorthand through to debootstrap.
+          # Install a pinned recent version directly; mkosi is
+          # pure-Python so --break-system-packages is harmless here.
+          sudo pip install --break-system-packages mkosi==24.3
 
       - name: Install templ
         run: go install github.com/a-h/templ/cmd/templ@v0.3.1001