OCI pulls create .mstack machine images, which vmspawn can
discover via -M. Since vmspawn only supports directory and disk
images, this currently reaches assert_not_reached() and aborts.
Return EOPNOTSUPP with a readable error instead.
Fixes#41541
When an administrator installed a custom keyring under /etc,
signature verification selected it instead of the vendor keyring
under /usr. That could make vendor-signed system updates stop
verifying after adding local keys.
Collect all readable default keyrings, including the current and
legacy /etc paths, and pass temporary copies to GnuPG with
separate --keyring options. Keep SYSTEMD_OPENPGP_KEYRING as an
explicit override, add regression coverage for keyring
coexistence, override behavior, and current-path signing, and
silence the expected shellcheck false positive in the test
cleanup helper.
Closes: #40702
zouge666