live-image: stage agent binary via mkosi.extra

mkosi only mounts live-image/ as /work/src, so the postinst couldn't
reach the repo-root bin/vetting-agent.linux-amd64 — the build failed
in CI with `install: cannot stat '/work/src/bin/vetting-agent.linux-amd64'`.

The Makefile now copies the prebuilt agent into mkosi.extra/, which
mkosi merges into the image root automatically. The postinst is
reduced to creating the multi-user.target.wants symlink.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

live-image/mkosi.postinst

@@ -1,15 +1,10 @@
 #!/bin/sh
-# mkosi postinst: install the vetting-agent binary and its systemd unit
-# into the image. The binary must already be built for linux-amd64 at
-# repo root under bin/vetting-agent.linux-amd64 (the top-level Makefile
-# does this via `make agent-linux`).
+# mkosi postinst: enable the vetting-agent service. The binary lands in
+# the image via mkosi.extra/ (staged by the live-image Makefile from
+# ../bin/vetting-agent.linux-amd64); the service unit lands via
+# mkosi.skeleton/. All we need here is the multi-user.target symlink.
 set -eu
 
-AGENT_BIN="${SRCDIR:-..}/bin/vetting-agent.linux-amd64"
-
-install -D -m 0755 "$AGENT_BIN" "$BUILDROOT/usr/local/sbin/vetting-agent"
-install -D -m 0644 "$SRCDIR/mkosi.skeleton/etc/systemd/system/vetting-agent.service" \
-    "$BUILDROOT/etc/systemd/system/vetting-agent.service"
-
+mkdir -p "$BUILDROOT/etc/systemd/system/multi-user.target.wants"
 ln -sf /etc/systemd/system/vetting-agent.service \
     "$BUILDROOT/etc/systemd/system/multi-user.target.wants/vetting-agent.service"