RHEL-85652 tests system-roles during the bootc container build, which should be the primary mode. But for some cases it is also desirable to run system-roles on an already deployed system. However, we expect that most roles won't work there, so we should explicitly opt-in and mark them as supported in that mode (using our usual tags).

Create the tox-lsr/.github.git mechanics and at least a draft PR for the sudo (or other simple) role which builds a custom bootc container and qcow using a dedicated test (or specially tagged ones), and run another "validation phase" tests with our QEMU runner against that qcow image. This will require some changes to run against a local .qcow2 instead of one from the official linux-system-roles.json.