live-image: stage agent binary via mkosi.extra

mkosi only mounts live-image/ as /work/src, so the postinst couldn't
reach the repo-root bin/vetting-agent.linux-amd64 — the build failed
in CI with `install: cannot stat '/work/src/bin/vetting-agent.linux-amd64'`.

The Makefile now copies the prebuilt agent into mkosi.extra/, which
mkosi merges into the image root automatically. The postinst is
reduced to creating the multi-user.target.wants symlink.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

live-image/Makefile

@@ -10,9 +10,10 @@ endif
 
 REPO_ROOT := $(abspath ..)
 AGENT_BIN := $(REPO_ROOT)/bin/vetting-agent.linux-amd64
+MKOSI_EXTRA_AGENT := mkosi.extra/usr/local/sbin/vetting-agent
 
 .PHONY: all check-linux agent clean
-all: check-linux agent
+all: check-linux $(MKOSI_EXTRA_AGENT)
 	mkosi --force build
 
 agent: $(AGENT_BIN)
@@ -20,6 +21,11 @@ agent: $(AGENT_BIN)
 $(AGENT_BIN):
 	cd $(REPO_ROOT) && GOOS=linux GOARCH=amd64 go build -o $(AGENT_BIN) ./cmd/vetting-agent
 
+# Stage the prebuilt agent into mkosi.extra/ so mkosi copies it into the
+# image root without the postinst needing to reach outside the source tree.
+$(MKOSI_EXTRA_AGENT): $(AGENT_BIN)
+	install -D -m 0755 $< $@
+
 check-linux:
 ifneq ($(UNAME_S),Linux)
 	@echo "ERROR: live-image must be built on Linux (you're on $(UNAME_S))."
@@ -29,4 +35,4 @@ endif
 	@command -v mkosi >/dev/null 2>&1 || { echo "ERROR: mkosi not installed. Try: apt install mkosi"; exit 1; }
 
 clean:
-	rm -rf build mkosi.output mkosi.cache
+	rm -rf build mkosi.output mkosi.cache mkosi.extra