Function shadow_sync_generator_impl 

pub(crate) fn shadow_sync_generator_impl(
    root: &Dir,
    unit_dir: &Dir,
) -> Result<bool>

Enable the statically-installed shadow sync unit by symlinking it into sysinit.target.wants/ in the generator output directory.

The unit file itself lives at /usr/lib/systemd/system/bootc-sysusers-shadow-sync.service and is shipped with bootc; the generator only performs conditional enablement.

We check existence of /etc/shadow rather than writability because systemd sandboxes generators in a private read-only mount namespace (see systemd.generator(7)), so any writability check would always fail even though /etc will be on its own writable mount by the time the service actually runs. The caller already gates on the ostree-booted marker, which guarantees we are on a bootc system where /etc is writable at service-run time.