kernel-install: keep ukify cmdline inside conf root

KERNEL_INSTALL_CONF_ROOT overrides kernel-install config lookup. When it
was set and cmdline was absent, 60-ukify still fell back to
/proc/cmdline and embedded host boot options into the target UKI.

Return an empty base cmdline in that case, matching the adjacent
90-loaderentry behavior of not searching outside the override root.

Reproducer:
  KERNEL_INSTALL_CONF_ROOT=$(mktemp -d) python3 -c '
  import runpy
  ns = runpy.run_path("src/kernel-install/60-ukify.install.in",
                      run_name="not_main")
  print(ns["kernel_cmdline_base"]())'

Before:
  The host /proc/cmdline was returned.

Follow-up for: 40c0c9d4bc

src/kernel-install/60-ukify.install.in

@@ -192,6 +192,9 @@ def kernel_cmdline_base() -> list[str]:
                 if not line.startswith('#')
                 for opt in line.split()]
 
+    if os.getenv('KERNEL_INSTALL_CONF_ROOT'):
+        return []
+
     # If we read /proc/cmdline, we need to do some additional filtering.
     options = Path('/proc/cmdline').read_text().split()
     return [opt for opt in options

src/kernel-install/test-kernel-install.sh

@@ -143,6 +143,44 @@ grep -qE 'initrd' "$BOOT_ROOT/the-token/1.1.1/initrd"
 
 # Install UKI
 if [ -f "$ukify" ]; then
+    python3 - "$ukify_install" <<'PY'
+import os
+import runpy
+import sys
+
+ns = runpy.run_path(sys.argv[1], run_name='not_main')
+
+class FakePath:
+    files = {
+        '/conf-root/cmdline': 'root=conf\n# ignored\nquiet splash\n',
+        '/proc/cmdline': 'BOOT_IMAGE=/vmlinuz initrd=/initrd root=fake quiet\n',
+    }
+
+    def __init__(self, path):
+        self.path = os.fspath(path)
+
+    def __truediv__(self, name):
+        return type(self)(os.path.join(self.path, name))
+
+    def exists(self):
+        return self.path in self.files
+
+    def read_text(self):
+        return self.files[self.path]
+
+module_globals = ns['kernel_cmdline_base'].__globals__
+module_globals['Path'] = FakePath
+
+os.environ.pop('KERNEL_INSTALL_CONF_ROOT', None)
+assert ns['kernel_cmdline_base']() == ['root=fake', 'quiet']
+
+os.environ['KERNEL_INSTALL_CONF_ROOT'] = '/conf-root'
+assert ns['kernel_cmdline_base']() == ['root=conf', 'quiet', 'splash']
+
+os.environ['KERNEL_INSTALL_CONF_ROOT'] = '/empty-conf-root'
+assert ns['kernel_cmdline_base']() == []
+PY
+
     mkdir "$D/sources/install.conf.d"
     cat >>"$D/sources/install.conf.d/override.conf" <<EOF
 layout=uki