live-image: fix firmware so i915 actually loads at boot

Previous attempt (c962d6d) added firmware-linux-nonfree to mkosi.conf,
but the CI bundle was still 63 MB and Tiger Lake wedged on tgl_guc.
Two reasons: (1) firmware-linux-nonfree on bookworm is a thin
metapackage that doesn't include firmware-misc-nonfree, which is where
i915 GuC/HuC blobs actually live; (2) Ubuntu's apt-packaged mkosi is
old enough that Repositories=non-free-firmware shorthand likely isn't
wired through to the debootstrap invocation, so firmware packages
silently miss the bootstrap step entirely.

Changes:
- Enumerate firmware packages explicitly in mkosi.conf (firmware-
  misc-nonfree, firmware-iwlwifi, firmware-realtek, firmware-amd-
  graphics, firmware-intel-sound, intel/amd64-microcode).
- Ship mkosi.sources.d/debian.sources with explicit deb822 so the
  non-free-firmware component is unambiguously available.
- Install mkosi 24.3 via pip in CI instead of apt's older build.
- Pin MODULES=most and COMPRESS=zstd via a tracked initramfs-tools
  config under mkosi.extra/.
- Narrow .gitignore so only the generated agent binary is ignored,
  not the whole mkosi.extra/ tree.
- New check-initrd Makefile target asserts both size (>=150 MB) and
  actual presence of i915/tgl_guc_*.bin inside the built initrd, so
  a silent firmware-drop regression fails the build loudly.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

live-image/mkosi.conf

@@ -12,6 +12,11 @@ Release=bookworm
 # amdgpu, nvidia-*, realtek NIC firmware, etc. — anything we'd want
 # when PXE-booting a random repaired host. Without it i915 wedges
 # on Tiger Lake+ and drags the serial console with it.
+#
+# Belt-and-suspenders: mkosi.sources.d/debian.sources ships an
+# explicit deb822 sources drop-in so the bootstrap step sees the
+# component regardless of how this shorthand is interpreted by the
+# mkosi version doing the build.
 Repositories=main non-free-firmware
 
 [Output]
@@ -39,6 +44,18 @@ Packages=
     dmidecode
     pciutils
     usbutils
+    initramfs-tools
+    # Firmware. firmware-linux-nonfree on bookworm is a thin metapackage
+    # that does NOT pull i915 GuC/HuC — those live in firmware-misc-nonfree.
+    # Enumerate explicitly so the blob for whatever hardware we boot on
+    # actually lands in /lib/firmware and then in the initrd.
+    firmware-misc-nonfree
+    firmware-iwlwifi
+    firmware-realtek
+    firmware-amd-graphics
+    firmware-intel-sound
+    intel-microcode
+    amd64-microcode
     firmware-linux-nonfree
 
 # Phase 4 will add: smartmontools stress-ng fio iperf3 lshw lm-sensors