build-sys: Avoid propagating local perms into /usr

The `cp -a lbi/usr/. /usr` command was preserving local directory
permissions which in one case for me have a restrictive mode 0750
which breaks booting.

Switch to `install -D -m 0644` which explicitly sets file modes and
creates parent directories with correct 755 permissions, while also
simplifying the directory structure.

Assisted-by: OpenCode (Opus 4.5)
Signed-off-by: Colin Walters <walters@verbum.org>

hack/provision-derived.sh

@@ -127,7 +127,7 @@ fi
 # for testing bootc install on Fedora CoreOS where these would conflict.
 if test -z "${SKIP_CONFIGS:-}"; then
   # For test-22-logically-bound-install
-  cp -a lbi/usr/. /usr
+  install -D -m 0644 -t /usr/share/containers/systemd/ lbi/*
   for x in curl.container curl-base.image podman.image; do
       ln -s /usr/share/containers/systemd/$x /usr/lib/bootc/bound-images.d/$x
   done