test(iso): verify bootloader rewriter handles AL8 inputs (#121 phase 3)

[SupremeCommanderHedgehog]

Summary

Phase 3 of #121 (AlmaLinux 8 support). Verification-only: confirms src/ks_gen/iso/bootloader.py rewrites AL8 ISO bootloader configs identically to AL9 — no rewriter code changes needed.

The rewriter's regex anchors pin isolinux/grub keywords, not AlmaLinux version strings:

Site	Pattern	What it matches
rewrite_isolinux entry-presence check	^label\s+\S+	any isolinux label entry
rewrite_isolinux menu-default cleanup	^[ \t]*menu\s+default\s*$	any menu default directive (0-or-1 hits handled)
rewrite_isolinux timeout edit	^timeout\s+\d+\s*$	any timeout NNN directive (prepended if absent)
rewrite_grub entry-presence check	^menuentry\s+	any grub menuentry
rewrite_grub timeout edit	^set\s+timeout=\d+\s*$	any set timeout=NNN (prepended if absent)
rewrite_grub default-entry edit	^set\s+default=.*$	any set default=... (prepended if absent)

AL8 ISO bootloader configs use the same isolinux 6.x + grub2 syntax as AL9. Only the embedded volid labels (AlmaLinux-8-10-x86_64-dvd) and version display strings (AlmaLinux 8.10) differ — both flow through the rewriter byte-for-byte. Phase 3 ships test coverage that pins this contract; no rewriter changes are required.

Spec: docs/superpowers/specs/2026-06-20-alma8-phase-3-iso-bootloader-verification-design.md

Test plan

• AL8 fixtures (new): tests/fixtures/alma8-bootloader/isolinux.cfg and grub.cfg — synthetic AL8.10-shaped configs mirroring the AL9 fixtures' structure with AlmaLinux-8-10-x86_64-dvd volid and "AlmaLinux 8.10" version strings.
• Bootloader tests (4 new in test_bootloader.py):
  • test_rewrite_isolinux_happy_path_al8(snapshot) — volid="ALMA8", syrupy snapshot.
  • test_rewrite_grub_happy_path_al8(snapshot) — volid="ALMA8", syrupy snapshot.
  • test_rewrite_isolinux_al8_idempotent — second call no-ops via the IDEMPOTENCY_MARKER guard.
  • test_rewrite_grub_al8_idempotent — same.
• Snapshot diff (tests/__snapshots__/test_bootloader.ambr): pure additions (+80 lines), no AL9 snapshot changes. ALMA8 volid lands correctly in all three inst.{stage2,repo,ks}=hd:LABEL=ALMA8 knobs, idempotency markers present.
• Custom-volid AL8 case not duplicated: the existing AL9 custom-volid test (test_rewrite_{isolinux,grub}_custom_volid) covers the volid plumbing through to the entry — that's distro-independent.
• Full CI chain run locally: ruff check && ruff format --check && mypy && pytest -q — all four green (933 passed = 929 from end of v0.26.0 + 4 new).
• Each commit on this branch is GPG-signed with BE707B220C995478.

Conventional commit prefix

This PR uses test(iso): rather than feat(iso): because no production code changes — the rewriter is verified to already work on AL8. release-please will not bump the version on this merge; the next functional change will roll this verification work into its release notes.

What's next

Phase 4 of #121 — ks-gen verify end-to-end against a real AL8.10 host. Requires:

1. Running the install-regression harness against an AL8.10 DVD ISO to confirm the bootloader rewrite actually boots into Anaconda (validates the synthetic fixtures match real AL8 ISOs).
2. Hands-off install via inst.ks=hd:LABEL=ALMA8.
3. SSH-in + oscap against ssg-almalinux8-ds.xml.
4. ks-gen verify reconcile against the host.

Real-world validation surfaces any quirks the synthetic fixtures miss.

Related: #81 (ubuntu2404 port story, complete), #118 (AppArmor extension for ubuntu2404 container_host).