Adding pinned uuid for rootfs

scripts/extract-artifacts.sh

@@ -23,6 +23,14 @@ DISABLE_DOT1X=${3:-false}
 # environments. Defaults to the literal placeholder so build-oci.sh's warning
 # fires if it was never set.
 NVMET_TRADDR=${NVMET_TRADDR:-NVMET_TRADDR}
+# Stable root-namespace UUID. The root device is referenced by-id
+# (/dev/disk/by-id/nvme-uuid.$ROOT_NS_UUID) rather than /dev/nvmeNn1 because
+# NVMe controller indices are NOT stable: a transient discovery controller can
+# take nvme0, pushing the I/O controller to nvme1, so a hardcoded node is a
+# latent brick in an immutable signed cmdline. MUST match ROOT_NS_UUID in
+# serving/spdk-setup.sh (which assigns it on the target via add_ns -u).
+ROOT_NS_UUID=${ROOT_NS_UUID:-f1ee7000-0000-4000-8000-000000000001}
+ROOT_DEV="/dev/disk/by-id/nvme-uuid.${ROOT_NS_UUID}"
 
 for bin in virt-copy-out virt-tar-out virt-ls mkfs.erofs veritysetup jq; do
     command -v "$bin" >/dev/null || { echo "ERROR: $bin not found on build host" >&2; exit 1; }
@@ -96,8 +104,8 @@ printf '%s' \
   "rd.nvmf.discover=tcp,${NVMET_TRADDR},4420 " \
   "root=/dev/mapper/root rootfstype=erofs rootflags=ro " \
   "systemd.verity=yes roothash=${ROOT_HASH} " \
-  "systemd.verity_root_data=/dev/nvme0n1 " \
-  "systemd.verity_root_hash=/dev/nvme0n1 " \
+  "systemd.verity_root_data=${ROOT_DEV} " \
+  "systemd.verity_root_hash=${ROOT_DEV} " \
   "systemd.verity_root_options=hash-offset=${HASH_OFFSET}" \
   > "$OUT/cmdline.txt"