Introduce a tier-0 image

This is basically just:

- kernel
- systemd
- selinux-policy-targeted
- bootc

Notably it doesn't have `rpm-ostree` or `rpm`, or many other things.
It also doesn't even have `linux-firmware`.

And no `openssh`!

It's almost certain that you need to derive from this, but
it should be a suitable starting point.

TODO: Add something like

```
$ dnf-system-bootstrap
Installing packaging tools from quay.io/fedora/fedora-boot-dnf@sha256:abcd...)
 # This would be basically all the packages not in tier-0 that
 # are enough to give `dnf install`
$ dnf install cowsay
 # Install critical stuff
$ dnf system-bootstrap remove
 # Remove everything that we added for the package system, that isn't
 # a dependency of what the user wants!
```

(In theory we could make this work with multi-stage builds, but
 it's a little hard)

tier-0/manifest.yaml

@@ -0,0 +1,62 @@
+
+# Modern defaults we want
+boot-location: modules
+tmp-is-dir: true
+# This one at least historically broke compatibility with Anaconda, but
+# let's use it by default now.
+machineid-compat: false
+# Be minimal
+recommends: false
+
+ignore-removed-users:
+  - root
+ignore-removed-groups:
+  - root
+etc-group-members:
+  - wheel
+  - sudo
+  - systemd-journal
+  - adm
+
+# Note that the default for c9s+ is sqlite; we can't rely on rpm being
+# in the target (it isn't in tier-0!) so turn this to host here.  This
+# does break the "hermetic build" aspect a bit.  Maybe eventually
+# what we should do is special case this and actually install RPM temporarily
+# and then remove it...
+rpmdb: host
+
+check-passwd:
+  type: "file"
+  filename: "passwd"
+check-groups:
+  type: "file"
+  filename: "group"
+
+automatic-version-prefix: "${releasever}.<date:%Y%m%d>"
+mutate-os-release: "${releasever}"
+
+remove-from-packages:
+  # Generally we expect other tools to do this (e.g. Ignition or cloud-init)
+  - [systemd, /usr/lib/systemd/system/sysinit.target.wants/systemd-firstboot.service]
+  # We don't want auto-generated mount units. See also
+  # https://github.com/systemd/systemd/issues/13099
+  - [systemd-udev, /usr/lib/systemd/system-generators/systemd-gpt-auto-generator]
+  # Drop some buggy sysusers fragments which do not match static IDs allocation:
+  # https://bugzilla.redhat.com/show_bug.cgi?id=2105177
+  - [dbus-common, /usr/lib/sysusers.d/dbus.conf]
+
+include:
+  - bootc.yaml
+  - initramfs.yaml
+
+packages:
+  # Even in tier-0, we have this.  If you don't want SELinux today, you'll need
+  # to build a custom image.
+  - selinux-policy-targeted
+  # Needed for tpm2 bound luks
+  - tpm2-tools
+
+# See https://github.com/coreos/bootupd
+arch-include:
+  x86_64: bootupd.yaml
+  aarch64: bootupd.yaml