Move all network-dependent operations into dedicated init steps so
transient failures (registry timeouts, Koji 503s, etc.) surface early
and don't abort a 3-hour test run mid-way.

Changes by area:

ci.yml:
- install-tests: split 'Integration tests' into two steps:
  'Build images and test binaries' (build + cargo compile) and
  'Integration tests' (actual test execution). Both cargo build
  invocations now precede any test run, so a network-induced cargo
  failure is immediately identifiable.
- test-baseconfigs: add missing 'Fetch external dependencies (with
  retry)' step (just build-fetch) before building the container, making
  it consistent with test-integration and test-upgrade.
- test-container-export: add 'Fetch external dependencies (with retry)'
  step; split ISO download into a separate 'Build container and fetch
  Anaconda ISO' step (just fetch-anaconda-iso) before the test step.

Justfile:
- Add fetch-anaconda-iso target: downloads the Anaconda boot ISO with
  --retry 5 --retry-delay 30 so transient CDN failures are retried.
  The existing test-container-export target now asserts the ISO exists
  rather than downloading it, making the network/test boundary explicit.
- Add bib_image and lbi_switch_images variables for images that must be
  pre-pulled on the GHA host (with retry) and exposed inside test VMs
  via --bind-storage-ro virtiofs, rather than pulled live during tests.
- Extend build-fetch to pull bib_image and lbi_switch_images with retry.
- Extend copy-lbi-to-rootful to include bib_image and lbi_switch_images
  (needed by the install-tests job which copies to root's storage).

hack/provision-fetch.sh + hack/packages.txt:
- Add skopeo to packages.txt (needed for busybox OCI pre-fetch below).
- At the end of the fetch stage, use skopeo to download busybox as an
  OCI layout at /usr/share/bootc-test/busybox-oci. This runs within the
  network-allowed fetch layer so the busybox image is baked into the
  test container image and available to the test VM without a registry
  pull.

tmt/tests/booted/readonly/030-test-composefs.nu:
- Replace 'docker://busybox' pull with 'oci:/usr/share/bootc-test/
  busybox-oci', using the pre-fetched OCI layout from provision-fetch.sh.

tmt/tests/booted/test-bib-build.nu + tmt/plans/integration.fmf:
- Add 'try_bind_storage: true' to the test's extra: block so xtask
  passes --bind-storage-ro to bcvk for plan-33. The BIB image
  (quay.io/centos-bootc/bootc-image-builder:latest) is pre-pulled on
  the GHA host and exposed via the virtiofs additionalimagestore, so
  'podman run ... ' inside the VM finds it locally.

tmt/tests/booted/test-logically-bound-switch.nu + tmt/plans/integration.fmf:
- Add 'try_bind_storage: true' to the test's extra: block (plan-21).
- In initial_setup, call 'bootc image pull-from-default-storage' for
  each bound image (ubi9/ubi-minimal:9.4, ubi9/ubi-minimal:9.3,
  alpine:latest) before building the derived container. These images are
  pre-pulled on the GHA host and visible inside the VM via
  additionalimagestore; pull-from-default-storage moves them into
  bootc's own storage so 'bootc switch' finds them there without a
  registry pull.

tmt/plans/integration.fmf (Packit/OSCI path):
- In the order-98 shell prepare step, copy hack/packit-reboot.yml to
  /tmp/packit-reboot.yml after extraction from the src.rpm.
- Change the order-99 Ansible playbook reference from a live GitHub URL
  to /tmp/packit-reboot.yml, eliminating the live github.com fetch
  during Packit gating runs.

Assisted-by: Claude (claude-opus-4-5-20251101)