[bfjelds (bfjelds)]

Add GRUB verity, Azure verity, root-verity, and usr-verity VM scenarios.

Part 11 of the 16-PR Tailor migration stack. Depends on #904.

This split preserves the aggregate migration content; the original tooling, image-config, and final trees are unchanged.

Stack

• test/images with tailor [1]: update vulnerable dependencies #896
• test/images with tailor [2]: fix Image Customizer arguments and signing backends #897
• test/images with tailor [3]: resolve base includes and track fragment dependencies #898
• test/images with tailor [4]: validate and fingerprint signing credentials #899
• test/images with tailor [5]: reject conflicting output paths before building #842
• test/images with tailor [6]: add Tailor workspace, shared assets, and basic test images #900
• test/images with tailor [7]: add installer image configs #901
• test/images with tailor [8]: add container and direct-streaming image configs #902
• test/images with tailor [9]: add verity image configs #903
• test/images with tailor [10]: add shared VM assets and GRUB scenarios #904
• test/images with tailor [11]: add VM verity scenarios #905 (this PR)
• test/images with tailor [12]: add ACL-agent VM scenarios #906
• test/images with tailor [13]: add MOS image config using canonical shared inputs #843
• test/images with tailor [14]: build with tailor #844
• test/images with tailor [15]: remove legacy image system #845
• test/images with tailor [16]: move tests/tailor-images to tests/images #846

[azure-pipelines]

Azure Pipelines:
1 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🔵 Needs a closer look

Static review identified no blocking defects, but image-build and VM boot/update validation for these boot-critical configurations remains unverified.

No open issues 🎉

What changed in this PR

Adds verity-enabled VM image scenarios to the parallel Tailor workspace, extending the shared VM configuration introduced in #904 as part 11 of the migration stack.

Changes:

• Adds GRUB verity and Azure base/update images, plus root-verity and usr-verity images using unified kernel images.
• Defines shared OS settings, customization scripts, and scenario-specific storage layouts.
• Expands the scenario matrix, architecture exclusions, and build documentation.

All paths below are relative to tests/tailor-images/trident-vm-testimage/.

File	Description
README.md	Documents verity image build commands and outputs.
include/​uki-verity-scripts.yaml	Shares UKI verity customization scripts.
include/​uki-verity-os-common.yaml	Defines shared UKI boot and package settings.
include/​storage-usr-verity.yaml	Defines A/B storage with protected /usr.
include/​storage-root-verity.yaml	Defines A/B storage with protected root and writable /var.
include/​storage-grub-verity.yaml	Defines GRUB verity update-image storage.
include/​storage-grub-verity-base.yaml	Defines GRUB verity A/B base-image storage.
include/​storage-grub-verity-azure.yaml	Defines Azure update storage with a 7G disk cap.
include/​storage-grub-verity-azure-base.yaml	Defines Azure A/B storage with a 15G disk cap.
include/​grub-verity-scripts.yaml	Shares GRUB verity update-image scripts.
include/​grub-verity-os-common.yaml	Shares GRUB verity update OS settings.
include/​grub-verity-base-scripts.yaml	Shares base-image overlay and update preparation scripts.
include/​grub-verity-base-os-common.yaml	Shares GRUB verity base-image OS settings.
image.yaml	Registers six scenarios and architecture exclusions.
by-scenario/​usr-verity.yaml	Configures usr-verity COSI and qcow2 outputs.
by-scenario/​root-verity+usr-verity.yaml	Applies shared UKI configuration to both scenarios.
by-scenario/​root-verity.yaml	Configures root-verity outputs and writable /etc overlay.
by-scenario/​grub-verity+grub-verity-azure.yaml	Shares GRUB verity update configuration.
by-scenario/​grub-verity.yaml	Selects generic GRUB verity COSI output and storage.
by-scenario/​grub-verity-base+grub-verity-azure-base.yaml	Shares GRUB verity base-image configuration.
by-scenario/​grub-verity-base.yaml	Selects qcow2 output and A/B storage.
by-scenario/​grub-verity-azure.yaml	Adds Azure update-image packages and overrides.
by-scenario/​grub-verity-azure-base.yaml	Adds fixed VHD output and Azure base-image overrides.
by-arch+scenario/​arm64+grub-verity.yaml	Explicitly selects COSI output for arm64 GRUB verity.

_{Review effort: Balanced}