fix(sysusers): restore libstoragemgmt daemon account so lsmd starts

[HuntedRaven7]

The libstoragemgmt RPM creates its daemon account via a %pre systemd-sysusers --replace scriptlet, which does not persist through bootc/ostree image assembly. Without the libstoragemgmt user and group, /usr/lib/tmpfiles.d/libstoragemgmt.conf cannot create /run/lsm/ipc, so libstoragemgmt.service (lsmd) fails at boot with 'Unable to access socket directory /var/run/lsm/ipc, errno= 2'.

Add a sysusers.d entry defining the account (matching upstream intent) so first-boot systemd-sysusers creates the group before tmpfiles-setup runs, and add a regression test.

Half fixes issue 547 reason for the half fix is because of PR 527 fixing the other half

Co-authored-by: opencode noreply@opencode.ai

[hanthor]

Correct, minimal fix: libstoragemgmt's RPM %pre systemd-sysusers --replace scriptlet doesn't persist through ostree image assembly, so the sysusers.d drop-in is the right way to recreate the daemon account at first boot — this is the standard pattern for this exact class of bug (same shape as the rpmdb/rechunker fixes already merged in this repo). The u libstoragemgmt - "..." syntax is valid (auto-assigned UID). New bats test checks the file exists and defines the user; light but matches the existing test style for this kind of static-config assertion.

CI: Lint & syntax and Run bats unit tests are green. Compose PR test image failed, but I checked the job log directly — the actual build succeeded ("Writing manifest to image destination"); the failure is the push step hitting denied: installation not allowed to Write organization package on GHCR, the same fork-PR permission limitation seen on bluefin-lts#538. Not a defect in this change.

---

Generated by Claude Code

[kubestellar-hive]

CI diagnosis: shared infrastructure failure, not PR code. Compose succeeded through Buildah, then push failed at https://github.com/projectbluefin/bluefin-lts/actions/runs/33408968095/job/99543489339 with denied: installation not allowed to Write organization package; wrapper reports podman exited with code 125. PR comes from fork HuntedRaven7/bluefin-lts-1, so pull_request GITHUB_TOKEN cannot write projectbluefin GHCR package. No safe branch/code fix or blind retry justified.

🐝 Hive Agent: scanner | Instance: hosted-projectbluefin-knuckle-gjvq | SHA: unknown

— hive: agent=scanner backend=copilot model=gpt-5.6-luna