test: integration test for Asahi firstboot LVM setup

VM-based end-to-end test using Fedora cloud image with two disks:
root (20GB) + data (200GB). Verifies the firstboot script creates
labvg with correct LV sizes, mounts volumes, migrates /home content,
sets hostname, creates admin user, and handles reprovision.

Fixes to firstboot script:
- Detect whole disks (not just partitions) for LVM PV
- Handle btrfs subvolume paths in root device detection
- Copy /home content before mounting LV (preserves SSH keys)
- Don't restart sshd (config takes effect on reboot)
- Make swapon and mount operations resilient to failures

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

bastion/src/bastion/src/templates/asahi-firstboot.sh.ts

@@ -63,16 +63,21 @@ if [ -f "$MARKER" ]; then
 fi
 
 # ── Find the data partition ──────────────────────────────────────
-# The data partition is the large Linux partition that is NOT root.
-ROOT_DEV=$(findmnt -n -o SOURCE /)
-echo "Root device: $ROOT_DEV"
+# The data partition/disk is a large block device that is NOT the root filesystem.
+# Handles: NVMe partitions, SCSI partitions, whole unpartitioned disks.
+ROOT_DEV=$(findmnt -n -o SOURCE / | sed 's/\\[.*\\]//')  # strip btrfs subvol
+ROOT_DISK=$(lsblk -n -o PKNAME "$ROOT_DEV" 2>/dev/null | head -1)
+echo "Root device: $ROOT_DEV (disk: $ROOT_DISK)"
 
 DATA_PART=""
-for part in /dev/nvme*n*p* /dev/sd*[0-9]; do
+# Scan partitions first, then whole disks
+for part in /dev/nvme*n*p* /dev/sd*[0-9] /dev/vd*[0-9] /dev/nvme*n* /dev/sd[b-z] /dev/vd[b-z]; do
     [ -b "$part" ] || continue
-    # Skip root partition
+    # Skip root device and root disk
     [ "$part" = "$ROOT_DEV" ] && continue
-    # Skip small partitions (<50GB) — EFI, boot, APFS stubs
+    PART_DISK=$(basename "$part" | sed 's/p[0-9]*$//' | sed 's/[0-9]*$//')
+    [ "$PART_DISK" = "$ROOT_DISK" ] && continue
+    # Skip small devices (<50GB) — EFI, boot, APFS stubs
     SIZE_BYTES=$(blockdev --getsize64 "$part" 2>/dev/null || echo 0)
     SIZE_GB=$((SIZE_BYTES / 1073741824))
     [ "$SIZE_GB" -lt 50 ] && continue
@@ -80,7 +85,7 @@ for part in /dev/nvme*n*p* /dev/sd*[0-9]; do
     FSTYPE=$(blkid -o value -s TYPE "$part" 2>/dev/null || echo "")
     if [ -z "$FSTYPE" ] || [ "$FSTYPE" = "LVM2_member" ]; then
         DATA_PART="$part"
-        echo "Found data partition: $DATA_PART ($SIZE_GB GB)"
+        echo "Found data device: $DATA_PART ($SIZE_GB GB)"
         break
     fi
 done
@@ -159,23 +164,46 @@ mkfs.xfs /dev/labvg/home
 mkfs.xfs /dev/labvg/srv
 ${roleFormatLines.join('\n')}
 
-# Move existing /var content to LV
-echo "Migrating /var to LVM..."
-TMPVAR="/var.old.$$"
-mv /var "$TMPVAR"
-mkdir -p /var
-mount /dev/labvg/var /var
-cp -a "$TMPVAR"/. /var/ 2>/dev/null || true
-rm -rf "$TMPVAR"
+# Migrate and mount volumes that can be switched live.
+# Copy existing content first so we don't shadow files (e.g. /home/user/.ssh).
+for LV_MOUNT in "home /home" "srv /srv"; do
+    LV_NAME=$(echo "$LV_MOUNT" | awk '{print $1}')
+    MOUNT_PT=$(echo "$LV_MOUNT" | awk '{print $2}')
+    STAGING="/mnt/labvg-$LV_NAME-staging"
+    mkdir -p "$STAGING"
+    mount "/dev/labvg/$LV_NAME" "$STAGING"
+    cp -a "$MOUNT_PT"/. "$STAGING/" 2>/dev/null || true
+    umount "$STAGING"
+    rmdir "$STAGING"
+    mount_lv "$LV_NAME" "$MOUNT_PT"
+done
 
-# Mount remaining volumes
-mount_lv varlog /var/log
-mount_lv home /home
-mount_lv srv /srv
+# Mount role-specific volumes (empty, no content to preserve)
+set +e
 ${roleMountLines.join('\n')}
+set -e
+
+# Copy existing /var content into the LV for next boot
+echo "Preparing /var LV for next boot..."
+TMPVAR="/mnt/labvg-var-staging"
+mkdir -p "$TMPVAR"
+mount /dev/labvg/var "$TMPVAR"
+cp -a /var/. "$TMPVAR/" 2>/dev/null || true
+umount "$TMPVAR"
+rmdir "$TMPVAR"
+
+# Same for /var/log
+TMPVARLOG="/mnt/labvg-varlog-staging"
+mkdir -p "$TMPVARLOG"
+mount /dev/labvg/varlog "$TMPVARLOG"
+cp -a /var/log/. "$TMPVARLOG/" 2>/dev/null || true
+umount "$TMPVARLOG"
+rmdir "$TMPVARLOG"
+
+echo "NOTE: /var and /var/log will switch to LVM on next reboot."
 
 # Enable swap
-swapon /dev/labvg/swap
+swapon /dev/labvg/swap 2>/dev/null || true
 
 # Write fstab entries
 echo "" >> /etc/fstab
@@ -212,10 +240,9 @@ chmod 700 /root/.ssh
 (${sshKeyLines}) >> /root/.ssh/authorized_keys
 chmod 600 /root/.ssh/authorized_keys
 
-# ── Harden SSH ───────────────────────────────────────────────────
+# ── Harden SSH (takes effect on next sshd restart/reboot) ────────
 sed -i 's/^#\\?PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
 sed -i 's/^#\\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
-systemctl restart sshd 2>/dev/null || true
 
 # ── Write provisioning metadata ──────────────────────────────────
 cat > /etc/lab-provisioned << LABMETA