maintain selinux attributes into the erofs build

docs/TODO.md

@@ -99,9 +99,19 @@ is the tmpfs overlay), fleet-generic (no per-host state).
   e.g. a tightly-constrained kiosk session + documented deviation — when
   hardening lands.
 
-## [~] 5. Deploy & validate the end-to-end boot path (open-network test)
+## [x] 5. Deploy & validate the end-to-end boot path (open-network test)
 
-In progress. Stand up `serving/` (dnsmasq + nginx + SPDK) per
+✅ **DONE (2026-06-15).** Full chain validated on QEMU/Proxmox: UEFI HTTP boot →
+initramfs → DHCP → `nvmf-connect.service` auto-connects the NVMe/TCP subsystem →
+two namespaces (data + verity hash) appear by pinned UUID → `systemd-veritysetup`
+maps `/dev/mapper/root` → uncompressed erofs mounts → `systemd.volatile=overlay`
+→ multi-user. Booted with `rd.dot1x=0` (open network) and the IP discovery
+address. See bench findings below for the full list of fixes. Remaining cleanup
+to leave the lab-test posture (now unblocked): revert the hardcoded IP to the
+`nvme.fleet.lab` DNS name, and re-enable security (`DISABLE_DOT1X=false`) — the
+secure path needs the same connect trigger over macsec0 (see ⚠ note below).
+
+Original task: stand up `serving/` (dnsmasq + nginx + SPDK) per
 [serving/README.md](../serving/README.md), rebuild the UKI with
 `nvmet_traddr=nvme.fleet.lab` (now a Packer var — older UKIs have the literal
 `NVMET_TRADDR` placeholder and won't connect), then boot a UEFI HTTP-boot client
@@ -185,6 +195,18 @@ boot LAN.
     `systemd.verity_root_data=`/`systemd.verity_root_hash=` by-id devices with no
     offset. Touches `extract-artifacts.sh`, `build-oci.sh` (artifact list +
     SHA256SUMS), `serving/spdk-setup.sh` (2nd bdev/namespace), and invariant #9.
+  - **SELinux labels must survive into the erofs.** It booted to multi-user but
+    `root`/`packer-build-only` login was accepted then the session was killed
+    instantly. Cause: kickstart sets `selinux --enforcing`, but the build dropped
+    `security.selinux` xattrs (`virt-tar-out` + plain `tar -xpf` don't carry
+    them), so the enforcing target denied the login session on an unlabeled root
+    — and a read-only erofs can't autorelabel. Confirmed by booting with
+    `enforcing=0` (SMBIOS-injected) → login worked. **Fixed:** export via
+    `guestfish tar-out … selinux:true xattrs:true acls:true`, restore with
+    `tar --xattrs --xattrs-include='*' --acls --selinux`, and a `getfattr`
+    build-time assertion that `/usr/bin/bash` is labeled before `mkfs.erofs`
+    (mkfs.erofs preserves xattrs). Needs `attr` on the build host. The image now
+    boots **enforcing**.
     **⚠ The secure path has the same dependency on the
     (absent) nvmf autoconnect** — when 802.1X is re-enabled, the macsec0 path
     must likewise drive `connect-all` (or the network-manager port #1 must wire