split out hash because rocky doesnt support it inline

scripts/build-oci.sh

@@ -10,7 +10,8 @@
 #      verity.json -- a mismatched pair is an unbootable fleet
 #   4. builds a FROM-scratch OCI image containing ONLY:
 #        /artifacts/fleet-<version>.efi   (the signed UKI)
-#        /artifacts/rootfs.erofs          (erofs + appended verity tree)
+#        /artifacts/rootfs.erofs          (erofs DATA namespace)
+#        /artifacts/rootfs.hash           (dm-verity HASH namespace)
 #        /artifacts/verity.json
 #        /artifacts/SHA256SUMS
 #      Deploy as an initContainer (or k8s image volume) feeding the
@@ -79,7 +80,7 @@ echo "==> roothash coupling verified: $WANT"
 STAGE=$(mktemp -d)
 trap 'rm -rf "$STAGE"' EXIT
 mkdir "$STAGE/artifacts"
-cp "$UKI" "$ART/rootfs.erofs" "$ART/verity.json" "$STAGE/artifacts/"
+cp "$UKI" "$ART/rootfs.erofs" "$ART/rootfs.hash" "$ART/verity.json" "$STAGE/artifacts/"
 ( cd "$STAGE/artifacts" && sha256sum -- * > SHA256SUMS )
 
 REF="${IMAGE}:${VERSION}"