install/flat: Use composefs pipeline for rootfs

[ericcurtin]

--flat install implementation will go through the composefs
repository. This gives several advantages:

• SELinux labeling is handled by composefs-rs (selabel), which applies
  labels from the image's file_contexts rather than inheriting the
  running container's labels.
• The kernel installation flow is reused from composefs-rs
  (get_boot_resources / UsrLibModulesVmlinuz).
• The composefs repo is preserved at /sysroot/composefs, making it
  easy to convert to immutable/bootc mode later. Users who don't want
  the metadata overhead can rm -rf /sysroot/composefs.
• write_to_path supports reflink copies on btrfs/XFS, sharing blocks
  with the composefs object store.
• --source-imgref now works with --flat (the in_host_mountns guard is
  removed since we pull via the image reference, not via cp /).