fix(session): mount the boot FAT at /boot/firmware on Bookworm

Raspberry Pi OS Bookworm keeps the FAT boot partition at /boot/firmware, where
the raspi-firmware post-update hook syncs the initramfs. Binding it at /boot in
the chroot sent update-initramfs's output to the ext4 root, so the firmware
booted a stock initramfs without cryptsetup -> (initramfs) emergency shell, no
LUKS prompt. boot_bind_target() detects the layout and binds (and unmounts) the
FAT at the right place; legacy single-FAT layouts still use /boot.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/unit/test_image_session.py

@@ -60,3 +60,17 @@ def test_destructor_closes_luks_mapper(tmp_path, fake_runner):
     session.decrypt_root()
     session.destructor()
     assert len(fake_runner.find("luksClose", "linux-image-manager-uuid-1")) == 1
+
+
+def test_boot_bind_target_bookworm_uses_boot_firmware(tmp_path):
+    session = ImageSession(Device("sda"))
+    session.root_mount_path = tmp_path
+    (tmp_path / "boot/firmware").mkdir(parents=True)
+    assert session.boot_bind_target() == f"{tmp_path}/boot/firmware"
+
+
+def test_boot_bind_target_legacy_uses_boot(tmp_path):
+    session = ImageSession(Device("sda"))
+    session.root_mount_path = tmp_path
+    (tmp_path / "boot").mkdir()
+    assert session.boot_bind_target() == f"{tmp_path}/boot"