Fix raw USB live boot and verify both installation media paths

tests/test_image.py

@@ -501,6 +501,27 @@ class ImageBuildTests(unittest.TestCase):
         path.write_text('[{"package":"app-emulation/qemu-8.0", "use": [], "build_time": null}]')
         self.assertFalse(self.builder.complete('packages'))
 
+    def test_iso_refuses_hfs_hybrid_that_shadows_live_volume_on_usb(self):
+        from hydra.build import BuildError
+        self.inventory()
+        self.builder.complete = lambda step: step == 'rootfs'
+        self.builder.assembly = lambda: 'isolated-assembler'
+        artifacts = self.builder.work / 'artifacts'
+
+        def pod(*args, **kwargs):
+            self.assertEqual(args[:2], ('exec', 'isolated-assembler'))
+            (artifacts / 'hydra-os.iso').write_bytes(b'ISO fixture')
+            (artifacts / 'iso-inspection.txt').write_text(
+                'Volume id    : HYDRA_OS\n'
+                'El Torito boot img : 1 UEFI y none\n'
+                'System area summary: MBR protective-msdos-label GPT APM\n'
+                'GPT partname local : 3 HFSPLUS\n')
+
+        self.builder.pod = pod
+        with self.assertRaisesRegex(BuildError, 'HFS|APM'):
+            self.builder.iso()
+        self.assertFalse(self.builder.manifest()['iso']['complete'])
+
     def test_malformed_inventory_with_matching_digest_is_refused(self):
         for data in ['{', '{}', '[]', '[{"package":"wrong"}]',
                      '[{"package":"app-emulation/qemu-9.2.4", "use":"spice", "build_time":"123"}]',