Fix raw USB live boot and verify both installation media paths

hydra/build.py

@@ -500,14 +500,18 @@ cp /hydra-output/artifacts/squashfs.img "$tree/LiveOS/squashfs.img"
 cp /hydra-source/image/grub.cfg "$tree/boot/grub/grub.cfg"
 cp /hydra-output/artifacts/rootfs-manifest.json "$tree/build-manifest.json"
 cp /hydra-output/artifacts/packages.json "$tree/packages.json"
-grub-mkrescue --directory=/usr/lib/grub/x86_64-efi --output=/hydra-output/artifacts/hydra-os.iso "$tree" -- -volid HYDRA_OS
-xorriso -indev /hydra-output/artifacts/hydra-os.iso -report_el_torito plain -pvd_info > /hydra-output/artifacts/iso-inspection.txt 2>&1
+# GRUB's default HFS+ hybrid duplicates HYDRA_OS on a second filesystem.
+# On USB, dracut can select that label instead of the ISO9660 live payload.
+grub-mkrescue --directory=/usr/lib/grub/x86_64-efi --output=/hydra-output/artifacts/hydra-os.iso "$tree" -- -volid HYDRA_OS -hfsplus off
+xorriso -indev /hydra-output/artifacts/hydra-os.iso -report_el_torito plain -report_system_area plain -pvd_info > /hydra-output/artifacts/iso-inspection.txt 2>&1
 chmod 0644 /hydra-output/artifacts/hydra-os.iso /hydra-output/artifacts/iso-inspection.txt
 """
         self.pod('exec', assembler, '/bin/bash', '-euc', script)
         inspection = (self.work / 'artifacts/iso-inspection.txt').read_text()
         if 'HYDRA_OS' not in inspection or not re.search(r'El Torito boot img.*UEFI', inspection):
             raise BuildError('ISO does not report the expected volume label and UEFI boot image')
+        if re.search(r'\b(?:APM|HFSPLUS)\b', inspection):
+            raise BuildError('ISO contains an HFS+/APM hybrid that can shadow the live volume on USB')
         if image.source_identity(self.source_dir) != source_inputs:
             raise BuildError('Source inputs changed during ISO assembly; completion not recorded')
         checksum = image.digest(self.work / 'artifacts/hydra-os.iso')