Bind the io.systemd.SysUpdate.Notify.OnCompletedUpdate() method in the pcrlock Varlink server and hook a socket into /run/systemd/sysupdate/notify/ via systemd-sysupdate-notify-pcrlock.socket, enabled by default via the preset. When sysupdate signals a completed update, we unconditionally re-run make-policy, since the set of measured components may have changed.