Function inject_guest_init_dropins

crates/openshell-driver-vm/src/driver.rs:4678–4711

(
    overlay_disk: &Path,
    dropins: &[GuestInitDropin],
)

#[allow(clippy::result_large_err)]
fn inject_guest_init_dropins(
    overlay_disk: &Path,
    dropins: &[GuestInitDropin],
) -> Result<(), Status> {
    validate_guest_init_dropins(dropins).map_err(Status::failed_precondition)?;

    // Drop-ins are *executed* in a child shell by run_openshell_init_dropins
    // in the guest init script, not sourced into the parent. Mode 0o755 is
    // required (the runner skips anything that is not `-x`) and is the
    // contract drop-in authors should rely on.
    for dropin in dropins {
        let guest_path = overlay_upper_path(&format!("{GUEST_INIT_DROPIN_DIR}/{}", dropin.name));
        write_rootfs_image_file(overlay_disk, &guest_path, &dropin.contents).map_err(|err| {
            Status::internal(format!(
                "write VM guest init drop-in '{}' failed: {err}",
                dropin.name
            ))
        })?;
        set_rootfs_image_file_mode(overlay_disk, &guest_path, 0o755).map_err(|err| {
            Status::internal(format!(
                "set VM guest init drop-in '{}' executable failed: {err}",
                dropin.name
            ))
        })?;
    }

    // Write the allow-list manifest the guest runner consults. We write it
    // unconditionally — including an empty manifest when no drop-ins were
    // injected — so the guest always fails closed: only names the driver
    // explicitly injected this launch are eligible to run, and a guest
    // image cannot smuggle in extra `init.d` entries.
    write_guest_init_dropin_manifest(overlay_disk, dropins)?;
    Ok(())
}

/// Render the drop-in allow-list as newline-separated, ASCII-sorted,
/// de-duplicated names. Names are already validated to be path-safe by