composefs: Short-circuit upgrade when image digest matches booted

If the pulled image results in the same composefs digest as the
currently booted system, there is no new state to write. Attempting
to re-write the state crashes with EEXIST on the /var symlink (now
separately hardened). This safely updates the origin file to record
the new image reference instead, which is the correct behaviour when
switching transport (e.g. registry: to containers-storage:) for the
exact same image content.

Assisted-by: OpenCode (Claude Sonnet 4.5)
Signed-off-by: Colin Walters <walters@verbum.org>

Author: cgwalters

crates/lib/src/bootc_composefs/update.rs

@@ -275,6 +275,16 @@ pub(crate) async fn do_upgrade(
     )
     .await?;
 
+    // If the pulled image has the same composefs digest as the booted system,
+    // there's nothing to stage — just update the origin file to record the
+    // new imgref (e.g. a transport change from registry: to containers-storage:).
+    if id.to_hex() == *booted_cfs.cmdline.digest {
+        println!("Image already deployed, updating image reference");
+        return crate::bootc_composefs::state::update_target_imgref_in_origin(
+            storage, booted_cfs, imgref,
+        );
+    }
+
     let Some(entry) = entries.iter().next() else {
         anyhow::bail!("No boot entries!");
     };
@@ -413,11 +423,17 @@ pub(crate) async fn upgrade_composefs(
     let imgref = derived_image.as_ref().or(current_image);
     let mut booted_imgref = imgref.ok_or_else(|| anyhow::anyhow!("No image source specified"))?;
 
-    // Auto-detect unified storage: if the image is already in bootc-owned
-    // containers-storage (e.g. from a previous `bootc image set-unified`),
-    // use the zero-copy path.
-    do_upgrade_opts.use_unified =
-        crate::deploy::image_exists_in_unified_storage(storage, booted_imgref).await?;
+    // Auto-detect unified storage: use the unified path if the target image is
+    // already in bootc-owned containers-storage, OR if the booted image is —
+    // the latter means the user has opted into unified storage and all
+    // subsequent operations should use it.
+    let current_unified = if let Some(current) = current_image {
+        crate::deploy::image_exists_in_unified_storage(storage, current).await?
+    } else {
+        false
+    };
+    do_upgrade_opts.use_unified = current_unified
+        || crate::deploy::image_exists_in_unified_storage(storage, booted_imgref).await?;
 
     let repo = &*composefs.repo;