Enable readonly sysroot via config file

This is the more proper way to do it.

tier-0/bootc.yaml

@@ -1,7 +1,9 @@
+include:
+  - ostree.yaml
+
 # The bootc components.
 packages:
  - systemd
- - ostree nss-altfiles
  # For now this will be shipped in rpm-ostree; TODO fix this by shipping a separate epackage
  # - bootc
  # Required by bootc install today, though we'll likely switch bootc to use a Rust crate instead of sgdisk

tier-0/ostree.yaml

@@ -0,0 +1,12 @@
+packages:
+ - ostree nss-altfiles
+
+postprocess:
+  # Set up default root config
+  - |
+    #!/usr/bin/env bash
+    mkdir -p /usr/lib/ostree
+    cat > /usr/lib/ostree/prepare-root.conf << EOF
+    [sysroot]
+    readonly = true
+    EOF

tier-1/ostree.yaml

@@ -0,0 +1 @@
+../tier-0/ostree.yaml