end-to-end LUKS2 FIDO2 unlock test in bcvk VM with YubiKey passthrough

[foil-copy-overrate]

Validates ADR-003 (FIDO2 disk encryption) and ADR-009 (systemd-homed FIDO2) end-to-end in a running VM.

PR #13 merged the systemd-homed LUKS2+FIDO2 code. This issue tracks the first live test.

Test scenario:

1. Build yubiOS OCI image
2. Boot with bcvk ephemeral run --yubikey-passthrough
3. Verify disk unlock prompt appears and resolves on YubiKey tap (FIDO2 hmac-secret)
4. Verify systemd-homed home creation requires YubiKey touch
5. Verify ConditionSecurity=measured-os blocks enrollment on non-measured boot

Relates to: issue #9 (YubiKey USB passthrough)
ADR: ADR-003, ADR-009
Branch: feat/luks-fido2-e2e-test

[foil-copy-overrate]

⏳ Blocked by hardware + environment (BLOCKER-005). Needs: physical YubiKey 5, bcvk ephemeral run with YubiKey passthrough (#9), and base image with systemd 261 (#14). Spec is in 2026/luks-fido2-e2e-test.md on the branch.