fix(image): preserve installer kernel and verified update contracts

hydra/image.py

@@ -142,6 +142,8 @@ def kernel_image(root):
     candidates = [root_path(root, 'boot/' + prefix + version)
                   for prefix in ('kernel-', 'vmlinuz-')]
     images = [path for path in candidates if path.is_file()]
+    if len(images) == 2 and images[0].samefile(images[1]):
+        return images[1]  # Stable installer/GRUB vmlinuz alias for Gentoo kernel-bin.
     if len(images) != 1:
         raise ImageError('Installed modules require exactly one matching boot kernel image')
     return images[0]
@@ -256,6 +258,10 @@ def configure_rootfs(root, source):
         if not (source / name).is_file():
             raise ImageError(f'Required committed runtime/installer asset is missing: {name}')
     version = kernel_version(root)
+    kernel = kernel_image(root)
+    alias = root_path(root, 'boot/vmlinuz-' + version)
+    if not alias.exists():
+        alias.symlink_to(kernel.name)
     sanitize_rootfs(root)
     copy_overlay(root, source / 'image/rootfs')
     write(root, 'etc/hydra/live-mode/dracut.conf', (source / 'image/dracut.conf').read_text())