live-image: generate initrd explicitly; fail release on missing files

Two bugs chained together to ship a broken bundle:

1. With Bootable=no, mkosi skips update-initramfs, so no
   /boot/initrd.img-<kver> ever gets generated inside the rootfs.
   The postinst now runs update-initramfs via chroot to produce it.

2. The `make release` recipe chained its `cp` calls with `;`, so
   a missing live-image/build/initrd.img silently failed and the
   bundle still got tarred + uploaded. Adding `set -e` at the top
   of the recipe makes any missing component fail the build loudly
   instead of shipping a half-bundle.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Makefile

@@ -75,7 +75,8 @@ release: orchestrator-linux agent-linux live-image ## Build the scp-and-go relea
 ifneq ($(findstring Windows,$(UNAME_S))$(findstring MINGW,$(UNAME_S))$(findstring MSYS,$(UNAME_S)),)
 	@echo "ERROR: make release must be run from Linux/WSL (live-image dep needs mkosi)." && exit 1
 endif
-	@stamp=vetting-bundle-$(GIT_SHA); \
+	@set -e; \
+	  stamp=vetting-bundle-$(GIT_SHA); \
 	  rm -rf build/$$stamp bin/$$stamp.tar.gz; \
 	  mkdir -p build/$$stamp/bin build/$$stamp/live-image; \
 	  cp bin/vetting-linux-amd64 bin/vetting-agent.linux-amd64 build/$$stamp/bin/; \