Miscellaneous fixes

Other notes:

• The text appended to /etc/issue should mention that the password for the root account is "live".
• The live account does not have a password set, and cannot be logged into even though nullok_secure is set. Either its password should be set to "live" and mentioned in /etc/issue as well, or it should be possible to login without a password.
• The updated openrc package is not available for any arch other than ppc64 right now, so as a monkeypatch I did this:

--- a/image/backends/iso.cc
+++ b/image/backends/iso.cc
@@ -264,6 +264,11 @@ public:
         output_info("CD backend", "configuring mtab");
         write_etc_mtab_to(target);
 
+        /* XXX need rebuilt openrc */
+        run_command("cp", {"-PRr",
+                           target + "/usr/share/openrc/runlevels",
+                           target + "/etc/"});
+
         /* REQ: ISO.10 */
         output_info("CD backend", "enabling required services");
         const std::string targetsi = target + "/etc/runlevels/sysinit/";

• I tried running the entire thing under bubblewrap, and after replacing the mknod invocations in the initrd generation script with some hackery using MTREE, I almost succeeded. However, mounting the EFI filesystem image precluded this. That will need some serious thinking to work around.