test(ostree): pin greenboot to exact Copr NEVR

Listing greenboot in the blueprint with version = "*" isn't enough:
dnf always installs the highest NEVRA across all enabled repos, and
Copr snapshot builds conventionally use a Release starting at
"0.<timestamp>..." -- the same convention official pre-GA/rebuilt
packages use. Whenever BaseOS/AppStream ships a greenboot release
that outranks the current Copr build, dnf silently installs the
stock package and the test exercises unpatched code.

I first tried fixing this via blueprint [[customizations.repositories]]
priority + install_from, since that's the field osbuild-composer
exposes for repo precedence. Verified against a real osbuild-composer
(v176) on CentOS Stream 9, with a synthetic competing repo publishing
greenboot at a deliberately higher release, that those fields have no
effect on build-time depsolve -- composer-cli accepts and forwards
them fine, but the resolver still just picks the highest NEVRA
regardless. They only affect the .repo files written into the
resulting image for its own future dnf use.

What does work: resolve the exact version-release dnf sees in the
Copr repo via 'dnf repoquery --latest-limit=1' and pin both greenboot
packages to it directly. Verified this reliably wins even against the
adversarial higher-release competing repo.

Assisted-by: OpenCode (Claude Sonnet 5)

rh-pre-commit.version: 2.4.0
rh-pre-commit.check-secrets: ENABLED

Author: miabbott

tests/greenboot-ostree.sh

@@ -150,6 +150,30 @@ if [ "$copr_added" = false ]; then
     exit 1
 fi
 
+# Listing greenboot as a blueprint package (version = "*") is not enough to
+# guarantee it comes from Copr: dnf always installs the highest NEVRA across
+# all enabled repos, and Copr snapshot builds conventionally use a Release
+# starting at "0.<timestamp>...", the same convention official pre-GA/rebuilt
+# packages use. Whenever BaseOS/AppStream ships a greenboot release that
+# outranks the current Copr build, dnf silently installs the stock package
+# instead. Pin the exact version-release dnf resolves in the Copr repo so
+# there is only one candidate to resolve to, regardless of what other repos
+# offer. (Verified: neither `composer-cli sources add` nor a blueprint's
+# `[[customizations.repositories]]` priority/install_from affect depsolve at
+# build time -- those only shape the .repo files written into the resulting
+# image for its own future dnf use.)
+greenprint "Looking up exact greenboot NEVR from Copr build"
+GREENBOOT_COPR_NEVR=$(sudo dnf repoquery \
+    --repofrompath="greenboot-copr-lookup,${COPR_REPO_URL}" \
+    --disablerepo='*' --enablerepo=greenboot-copr-lookup \
+    --quiet --qf '%{version}-%{release}' --latest-limit=1 greenboot)
+
+if [ -z "$GREENBOOT_COPR_NEVR" ]; then
+    echo "Failed to resolve greenboot version-release from Copr repo ${COPR_REPO_URL}"
+    exit 1
+fi
+greenprint "Pinning greenboot to Copr build ${GREENBOOT_COPR_NEVR}"
+
 # Start firewalld
 greenprint "Start firewalld"
 sudo systemctl enable --now firewalld
@@ -381,11 +405,11 @@ version = "*"
 
 [[packages]]
 name = "greenboot"
-version = "*"
+version = "${GREENBOOT_COPR_NEVR}"
 
 [[packages]]
 name = "greenboot-default-health-checks"
-version = "*"
+version = "${GREENBOOT_COPR_NEVR}"
 
 [customizations.services]
 enabled = ["greenboot-healthcheck.service", "greenboot-set-rollback-trigger.service", "greenboot-success.target"]