Add concept of a buildroot-prep script

We want to fast-track the backport of
https://github.com/coreos/rpm-ostree/pull/5475 to unblock switch f44
and f43 over to the buildah path. Since this is likely not the first
time we'll do this and likely not only for FCOS, add a new concept of
an optional `buildroot-prep` script which can do $things like updating
packages before entering build-rootfs.

That specific script added here will not be automatically inherited by
coreos/rhel-coreos-config.

Containerfile

@@ -23,6 +23,10 @@ ARG MANIFEST=overridden
 # XXX: see inject_passwd_group() in build-rootfs
 ARG PASSWD_GROUP_DIR
 
+# this allows FCOS/SCOS/RHCOS to do specific things before going into the shared build-rootfs script
+RUN --mount=type=bind,target=/run/src \
+  if test -x /run/src/buildroot-prep; then /run/src/buildroot-prep; fi
+
 # useful if you're hacking on rpm-ostree/bootc-base-imagectl
 # COPY rpm-ostree /usr/bin/
 # COPY bootc-base-imagectl /usr/libexec/

buildroot-prep

@@ -0,0 +1,17 @@
+#!/bin/bash
+set -euo pipefail
+
+arch=$(uname -m)
+. /etc/os-release
+
+# fast-track backport of https://github.com/coreos/rpm-ostree/pull/5475
+
+case "$VERSION_ID" in
+    43) urls=(https://kojipkgs.fedoraproject.org//packages/rpm-ostree/2025.10/3.fc43/"$arch"/rpm-ostree-{,libs-}2025.10-3.fc43."$arch".rpm);;
+    44) urls=(https://kojipkgs.fedoraproject.org//packages/rpm-ostree/2025.10/3.fc44/"$arch"/rpm-ostree-{,libs-}2025.10-3.fc44."$arch".rpm);;
+    *) exit 0;;
+esac
+
+if rpm -q "rpm-ostree-2025.10-1.fc43.$arch"; then
+    sudo dnf install -y "${urls[@]}"
+fi