Initrd Repack

just exec composes capsem-gate pack-initrd before boot. The gate stages the configured guest binaries, atomically repacks the host initrd, regenerates its manifest and hash aliases, and then materializes runtime config. capsem-init prefers these initrd copies over the rootfs copies.

The authoritative inventory and paths are [initrd] in config/gate.toml. Do not add a second list to a recipe, test, or gate module.

Currently repacked binaries