Function primary_uki_candidate 

fn primary_uki_candidate(
    candidates: &[UkiComposefsCandidate],
) -> &UkiComposefsCandidate

Retain the historical V1 preference for the deployment identity while validating every fallback candidate. This avoids changing the naming of existing dual-format UKIs when their kernel arguments are reordered.