live-image: stage agent binary via mkosi.extra

mkosi only mounts live-image/ as /work/src, so the postinst couldn't
reach the repo-root bin/vetting-agent.linux-amd64 — the build failed
in CI with `install: cannot stat '/work/src/bin/vetting-agent.linux-amd64'`.

The Makefile now copies the prebuilt agent into mkosi.extra/, which
mkosi merges into the image root automatically. The postinst is
reduced to creating the multi-user.target.wants symlink.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

.gitignore

@@ -12,6 +12,10 @@
 vetting.yaml
 !deploy/vetting.example.yaml
 live-image/out/
+live-image/mkosi.extra/
+live-image/mkosi.cache/
+live-image/mkosi.output/
+live-image/build/
 .vscode/
 .idea/
 .claude/