live-image: fix check-initrd size measurement; add zstd to image

Previous run actually built the 518 MB rootfs with firmware-misc-nonfree
et al. installed — the real payload is working. Two follow-ups:

- check-initrd was reading stat on a symlink path and getting 30 bytes
  (the symlink's own size), not the 6.1.0-44-amd64 kernel initrd it
  points to. Switched to wc -c, which follows symlinks, and to du -hL
  for the OK message.
- Add zstd to Packages= so COMPRESS=zstd in initramfs.conf can be
  honored; without it update-initramfs falls back to gzip with a
  "No zstd in PATH" warning.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

live-image/Makefile

@@ -26,7 +26,10 @@ all: check-linux $(MKOSI_EXTRA_AGENT)
 #      blob presence check trips.
 # Requires unmkinitramfs (from initramfs-tools on the build host).
 check-initrd:
-	@size=$$(stat -c%s build/initrd.img); \
+	@# build/initrd.img is a symlink into build/boot/; use wc -c (which
+	@# follows symlinks) to get the real byte count. `stat -c%s` without
+	@# -L returns the symlink's path length instead of the target size.
+	@size=$$(wc -c < build/initrd.img); \
 	 min=$$((150 * 1024 * 1024)); \
 	 if [ "$$size" -lt "$$min" ]; then \
 	   echo "ERROR: initrd.img is $$size bytes (< $$min) — firmware almost certainly missing."; \
@@ -43,7 +46,7 @@ check-initrd:
 	   echo "       Check MODULES= in /etc/initramfs-tools/initramfs.conf."; \
 	   exit 1; \
 	 fi
-	@echo "initrd.img OK ($$(du -h build/initrd.img | cut -f1), i915 firmware present)"
+	@echo "initrd.img OK ($$(du -hL build/initrd.img | cut -f1), i915 firmware present)"
 
 agent: $(AGENT_BIN)