https://github.com/containers/composefs-rs/tree/main/examples shows lots of ways to cobble this together with bespoke Containerfiles, but I don't think we want the ultimate end-user experience to be "read this doc, write your own Containerfile that looks like this but does what you need it to do".

Instead, this should probably be a function of either `bootc-base-imagectl` or maybe a new related tool (since sealed images aren't exactly "base" images?). Something like:

$ bootc-img-frobber --from quay.io/example/my-normal-bootc-img --to quay.io/example/my-sealed-img [--uki or --bls or whatever args to control the output image]

So ideally I don't want a separate workflow, instead I'd rather have a "normal" bootc derived build, followed by one additional step to reprocess the "normal" build into a sealed-compatible format. Maybe that's naive and not possible but I wanted to at least write it down so we can start iterating on how it will actually work.