reboot: Propagate a refused reboot as an error

[cgwalters-bot]

bootc reboots by running systemctl reboot through systemd-run, so that it runs outside bootc's mount namespace. Without --wait, bootc only learns that the transient unit started, not whether the reboot was accepted. It then parks and waits for the SIGTERM from shutdown. If logind refuses the reboot, that SIGTERM never comes, and bootc upgrade --apply (and so bootc-fetch-apply-updates.service) hangs instead of failing.

systemd 257 and later refuse reboots from root while a block mode shutdown inhibitor is held, so this can happen today. This PR adds --wait --pipe --collect, which brings the exit status and systemctl's error message back to bootc.

There is a small race. Once the reboot has been accepted, shutdown can stop the transient unit or kill systemd-run before it reports success. bootc would then print an error and exit while the system goes down, instead of being terminated by SIGTERM. The window is short, because systemctl reboot returns as soon as the job is queued, and the reboot happens either way.

--wait and --pipe also talk to systemd over the D-Bus system bus rather than /run/systemd/private. Where dbus isn't running (e.g. rescue.target), --apply now fails loudly and keeps the staged changes. A code comment notes this.

This is split out of the reboot inhibitor PR (bootc#1047), which builds on it.

Testing

• Reproduction, in ephemeral bcvk VMs of the published images, run as root with systemd-inhibit --what=shutdown --mode=block held:
  • centos-bootc:stream10 (systemd 257): systemd-run --quiet -- systemctl reboot, which is bootc's current invocation, exited 0 and the VM stayed up. That's the case where bootc waits forever. systemd-run --quiet --wait --pipe --collect -- systemctl reboot exited 1 and printed Operation inhibited by "probe" ... reason is "testing".
  • centos-bootc:stream9 (systemd 252): the current invocation just rebooted, because logind there doesn't enforce the lock for root. That's the gap the follow-up PR closes.
• just validate and just unit-tests (443 tests) passed on a 16-core RHEL 10 devspace, rebased on current main (41049cc). The branch was built in its own checkout, with its own cargo target and buildah cache directories, and the built image reports g2dde3623.

Generated-by: https://github.com/cgwalters/#llms

---

Review draft in cgwalters-forge, not upstream yet. This section is removed when the PR is opened upstream.

• Upstream: bootc-dev/bootc, base main
• Board item: PVTI_lADOE9oHIs4BlJLczg9kEQc
• Fork CI: off; the devspace testing described above is this PR's CI, and upstream CI runs once it is opened there

To review:

• Approve, or comment /promote on a line of its own, to open it upstream, ready for review. Either covers only the commits pushed so far.
• If upstream requires DCO, approving also signs off: promote adds Signed-off-by: Colin Walters <walters@verbum.org> to the commits lacking it (the bot's and yours; anyone else's only if you ask), with you as committer.
• Add a /draft line (in the same comment or before) to open it upstream as a draft (/ready undoes that).
• Close to drop it.
• Edit the title and description freely: they become the upstream PR's. Review comments are squashed into the commits they concern, with a reply here.