image: Fix Unified/Partial semantics on non-unified-storage systems

On systems where unified storage is not enabled (no composefs/bootc.json),
images in bootc's containers-storage should be reported as 'unified' — the
original semantics meaning 'available via bootc storage for podman'. The
composefs cross-reference check (Partial vs Unified) only makes sense when
the unified-storage three-store pipeline has been opted into.

Without this fix, plan-01-readonly would fail because 010-test-bootc-
container-store.nu asserts pulled images appear as 'unified'.

Assisted-by: OpenCode (claude-sonnet-4-6@default)
Signed-off-by: Colin Walters <walters@verbum.org>

Author: cgwalters

crates/lib/src/image.rs

@@ -96,18 +96,30 @@ async fn list_host_images_composefs(sysroot: &crate::store::Storage) -> Result<V
         .await
         .context("Listing containers-storage images")?;
 
-    // Build the set of config digests (= image IDs) that have a complete
-    // composefs import.
-    //
-    // We match by config digest rather than manifest digest because podman may
-    // report a different manifest digest than composefs (e.g. when layers are
-    // recompressed during the copy into containers-storage).  The config digest
-    // is stable across such transformations and is also the image ID that
-    // podman reports.
-    //
-    // For each bootc composefs tag, open the OCI image to retrieve its config
-    // digest, then look that up against the cstorage image IDs (which are also
-    // config sha256 hashes).
+    // On systems where unified storage is NOT enabled, all images in bootc's
+    // containers-storage are reported as "unified" (original semantics: available
+    // via bootc storage for podman). The composefs cross-reference check only
+    // applies when the unified-storage flag has been set.
+    let unified_enabled = crate::store::BootcRepoMeta::read(sysroot_dir)?
+        .map(|m| m.unified_storage)
+        .unwrap_or(false);
+
+    if !unified_enabled {
+        return Ok(images
+            .into_iter()
+            .flat_map(|entry| {
+                entry.names.unwrap_or_default().into_iter().map(|name| ImageOutput {
+                    image: name,
+                    image_type: ImageListTypeColumn::Unified,
+                })
+            })
+            .collect());
+    }
+
+    // On unified-storage systems, cross-reference against composefs tags to
+    // determine whether each image went through the full three-store pipeline.
+    // We match by config digest (= image ID, stable across layer recompression)
+    // rather than manifest digest (which may differ after copying).
     let composefs_config_digests: std::collections::HashSet<String> =
         match sysroot.get_ensure_composefs() {
             Ok(repo) => {
@@ -131,18 +143,14 @@ async fn list_host_images_composefs(sysroot: &crate::store::Storage) -> Result<V
         .into_iter()
         .flat_map(|entry| {
             let names = entry.names.unwrap_or_default();
-            // The cstorage image ID is the config sha256 (e.g. "sha256:abc...").
-            // Match against composefs config digests for stable cross-referencing.
-            let image_type = if composefs_config_digests.is_empty() {
-                // No composefs repo / no tags yet — conservatively mark partial.
-                ImageListTypeColumn::Partial
-            } else if {
+            let image_type = if {
                 let id = &entry.id;
                 composefs_config_digests.contains(&format!("sha256:{id}"))
                     || composefs_config_digests.contains(id.as_str())
             } {
                 ImageListTypeColumn::Unified
             } else {
+                // In composefs storage but not composefs-tagged — partial import.
                 ImageListTypeColumn::Partial
             };
             names.into_iter().map(move |name| ImageOutput {