feat: trigger rollback at update-time via ostree-finalize-staged

Change greenboot-set-rollback-trigger.service to run when bootc update
or rpm-ostree upgrade stages a deployment, instead of at next boot.

The service is now RequiredBy=ostree-finalize-staged.service and ordered
Before= it, matching the pattern used by the original bash greenboot's
greenboot-grub2-set-counter.service. This means the rollback trigger
and fallback grub variables are set immediately when an update is
staged, not deferred to the next boot.

Removed: ConditionNeedsUpdate, boot-time ordering (sysinit.target,
systemd-update-done.service), WantedBy boot targets.
Added: ConditionPathExists=/run/ostree-booted, RequiresMountsFor=/boot,
PrivateMounts=yes, RemainAfterExit=yes.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: say-paul

usr/lib/systemd/system/greenboot-set-rollback-trigger.service

@@ -1,17 +1,15 @@
 [Unit]
 Description=Greenboot Rollback trigger
 DefaultDependencies=no
-After=local-fs.target
-Before=systemd-update-done.service greenboot-healthcheck.service
-Before=sysinit.target shutdown.target
-Conflicts=shutdown.target
-ConditionNeedsUpdate=|/etc
-ConditionNeedsUpdate=|/var
+Before=ostree-finalize-staged.service
+RequiresMountsFor=/boot
+ConditionPathExists=/run/ostree-booted
 
 [Service]
 Type=oneshot
-Restart=no
+RemainAfterExit=yes
 ExecStart=/usr/libexec/greenboot/greenboot set-rollback-trigger
+PrivateMounts=yes
 
 [Install]
-WantedBy=systemd-update-done.service greenboot-healthcheck.service
+RequiredBy=ostree-finalize-staged.service