extract-artifacts: strip NUL from SELinux context in status echo

getfattr --only-values emits the NUL-terminated security.selinux value;
bash's $(...) then warns "ignored null byte in input". Pipe through
tr -d '\0' to silence the cosmetic warning. The label assertion above is
unaffected.

scripts/extract-artifacts.sh

@@ -138,7 +138,10 @@ if ! getfattr -h -n security.selinux "$WORK/root/usr/bin/bash" >/dev/null 2>&1;
     echo "       An enforcing boot would deny login. Check guestfish/tar xattr flags." >&2
     exit 1
 fi
-echo "==> SELinux labels preserved (bash: $(getfattr -h --only-values -n security.selinux "$WORK/root/usr/bin/bash" 2>/dev/null))"
+# tr -d '\0': SELinux xattr values are NUL-terminated; without stripping it bash
+# warns "ignored null byte in input" on the command substitution (cosmetic only —
+# the label check above already passed).
+echo "==> SELinux labels preserved (bash: $(getfattr -h --only-values -n security.selinux "$WORK/root/usr/bin/bash" 2>/dev/null | tr -d '\0'))"
 
 echo "==> Building reproducible erofs image"
 # UNCOMPRESSED on purpose: the target Rocky 9 kernel's erofs is built without