Add usroverlay --readonly

[evan-goode]

Resolves #2034.

[gemini-code-assist]

Code Review

This pull request adds a --readonly flag to the usroverlay command, allowing the creation of a read-only transient overlay on /usr. The changes are well-implemented across the CLI, the two backends (ostree and composefs), documentation, and tests. The code is clear and the new functionality is tested. I have one minor suggestion to improve code conciseness.

[gemini-code-assist]

This match statement can be simplified into an if/else expression to make it more concise.

Suggested change

	let args = match access_mode {
	// In this context, "--transient" means "read-only overlay"
	FilesystemOverlayAccessMode::ReadOnly => ["admin", "unlock", "--transient"].as_slice(),
	FilesystemOverlayAccessMode::ReadWrite => ["admin", "unlock"].as_slice(),
	};
	let args: &[&str] = if access_mode == FilesystemOverlayAccessMode::ReadOnly {
	// In this context, "--transient" means "read-only overlay"
	&["admin", "unlock", "--transient"]
	} else {
	&["admin", "unlock"]
	};