install/aleph: include the image labels in aleph

[jbtrystram]

Include the container labels in the aleph file, since they often contain useful information about the image provenance, such as the source commit the image was build from.

Also we skip serializing the source image reference if it start with /tmp since this is a good signal it was source from a local copy of an image, e.g. in an osbuild environnement.

Whith this, a build of Fedora CoreOS through osbuild goes from:

{
  "image": "/tmp/tmpb29j6pi3/image",
  "kernel": "6.18.12-200.fc43.x86_64",
  "selinux": "disabled",
  "timestamp": null,
  "version": "43.20260301.20.dev1"
}

to

{
  "digest": "sha256:07bf537cc4e4d208eb0b978f76e5046e55529ce6192b982d8c1a41fa1d61b95a",
  "kernel": "6.18.13-200.fc43.x86_64",
  "labels": {
    "com.coreos.inputhash": "fe9883169714c593d98058606e886b9747710ed15ab1b9cdbd7fa538fb435b3c",
    "com.coreos.osname": "fedora-coreos",
    "com.coreos.stream": "testing-devel",
    "containers.bootc": "1",
    "io.buildah.version": "1.42.2",
    "org.opencontainers.image.description": "Fedora CoreOS testing-devel",
    "org.opencontainers.image.revision": "233fe18749c7d2749581e4307c4cac60967acde4",
    "org.opencontainers.image.source": "git@github.com:jbtrystram/fedora-coreos-config.git",
    "org.opencontainers.image.title": "Fedora CoreOS testing-devel",
    "org.opencontainers.image.version": "43.20260301.20.dev1",
    "ostree.bootable": "1",
    "ostree.commit": "89635f7cba9de932fc60d71a6bded65ad0db06a35c9d016da03ca7ade9ba4736",
    "ostree.final-diffid": "sha256:12787d84fa137cd5649a9005efe98ec9d05ea46245fdc50aecb7dd007f2035b1"
  },
  "selinux": "disabled",
  "target-image": "ostree-image-signed:docker://quay.io/fedora/fedora-coreos:testing-devel",
  "timestamp": null,
  "version": "43.20260301.20.dev1"
}

which is way more useful.

See #2038

Assisted-by: OpenCode(Opus 4.6)

[gemini-code-assist]

Code Review

This pull request enhances the installation provenance data stored in .bootc-aleph.json. It adds the manifest digest, target image reference, and OCI labels of the installed image, providing more useful information about the image's origin. It also intelligently skips serializing the source image reference when it appears to be a temporary local path, which is common in build environments like osbuild. The changes are well-implemented, with corresponding updates to the data structures and documentation. The code looks correct and improves the utility of the provenance file.

_{Note: Security Review did not run due to the size of the PR.}

[cgwalters]

Looks OK, just one nit. Could also use a test in the tmt readonly tests.

[cgwalters]

Missing DCO

[jbtrystram]

Could also use a test in the tmt readonly tests.

Added a test and signed-off the commit