Introduce bootc-base-imagectl

- Embed the manifests into the container image
- Add bootc-base-imagectl which is a tightly controlled frontend
  to execute on those manifests.

For now, we don't attempt to rework how we build the standard
image to actually look like `dnf install`, but we show that
it can work.

Signed-off-by: Colin Walters <walters@verbum.org>

tests/Containerfile.test-c10s

@@ -0,0 +1,31 @@
+# This test case exercises using the fedora-bootc image as a builder
+# to generate a minimal target image derived from CentOS Stream 10 content,
+# and then further extends it in a secondary phase.
+FROM quay.io/centos/centos:stream10 as repos
+
+# This is intentionally a locally built image
+FROM localhost/fedora-bootc as builder
+RUN --mount=type=bind,from=repos,src=/,dst=/repos,rw /usr/libexec/bootc-base-imagectl build-rootfs --manifest=standard/manifest /repos /target-rootfs
+
+# This pulls in the rootfs generated in the previous step
+FROM scratch
+COPY --from=builder /target-rootfs/ /
+RUN <<EORUN
+set -xeuo pipefail
+# Verify we have CentOS content
+. /usr/lib/os-release
+test "$ID" = centos
+
+# And install a package
+dnf -y install strace
+dnf clean all
+
+# Cleanup and lint
+rm /var/log /var/cache/* /var/lib/dnf
+bootc container lint
+EORUN
+LABEL containers.bootc 1
+ENV container=oci
+STOPSIGNAL SIGRTMIN+3
+CMD ["/sbin/init"]
+