fn generate_early_tmpfiles(unit_dir: &Dir) -> Result<()>Expand description
On native composefs boots (no ostree-remount), ensure /var/lib/systemd exists before services that need it.
Without this, systemd-tmpfiles-setup and systemd-random-seed race: both
are wanted by sysinit.target with no ordering between them. If the
container image has a sparse /var (e.g. after rm -rf /var/lib for the
var-tmpfiles lint), /var/lib/systemd won’t exist when random-seed starts.
A .mount unit (e.g. var-lib-nfs-rpc_pipefs.mount) may even create
/var/lib with an unlabeled_t SELinux context before policy loads, causing
an AVC denial when random-seed tries to mkdir /var/lib/systemd.
The generated unit runs systemd-tmpfiles for just /var/lib/systemd,
ordered only after what random-seed itself is ordered after, so it can’t
add an ordering cycle; see bootc-dev/bootc#2624.
On ostree boots, ostree-remount.service already provides this ordering.