Constant KERNEL_INSTALL_CONF_ROOT 

const KERNEL_INSTALL_CONF_ROOT: &str = "/tmp";

Redirect bootctl’s entry-token write into a tmpfs scratch area.

bootctl unconditionally writes <KERNEL_INSTALL_CONF_ROOT>/entry-token during installation. Because systemd’s path_join() is naive string concatenation (see src/bootctl/bootctl-install.c), setting this to /tmp causes the write to land at <composefs_root>/tmp/entry-token on the MountedImageRoot tmpfs, where it is automatically discarded. bootc does not use the entry-token at all.